The Mojo::JWT library for Perl contains a critical timing side-channel vulnerability that allows unauthenticated attackers to forge authentication tokens.

The decode method performs HMAC signature verification using Perl's non-constant-time eq operator, which creates an observable timing discrepancy. An unauthenticated attacker can measure the time taken for signature comparisons across multiple requests to reconstruct valid signatures and bypass authentication.

The ability to forge authentication tokens represents a severe risk to application integrity and user security. By successfully exploiting this timing discrepancy, an attacker can impersonate arbitrary users or gain unauthorized administrative access, potentially leading to full system compromise. While the CVSS score is 9.8, the enrichment data provides a more nuanced technical vector of 3.1, though the risk remains high due to the potential for total authentication bypass.

Immediate Action: Upgrade to Mojo::JWT version 1.02 or later, which utilizes the constant-time Mojo::Util::secure_compare function to prevent timing leaks.

Proactive Monitoring: Monitor application access logs for unusual patterns of repeated, high-frequency requests to authentication or token-decoding endpoints, which may indicate an attempt to collect timing data.

Compensating Controls: Ensure that any infrastructure sitting in front of the application does not introduce jitter or buffering that might inadvertently mask or, conversely, exacerbate timing variations, although updating the core library is the only effective mitigation.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a significant risk to any Perl application relying on Mojo::JWT for session management or authentication. Given the ease with which token forgery can be achieved once the signature is recovered, organizations must prioritize upgrading to version 1.02 immediately. Delaying this patch may allow attackers to systematically compromise user sessions without leaving traditional signs of intrusion.