ETK-2026-2266Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2266",
  "cve_id": null,
  "display_id": "ETK-2026-2266",
  "ghsa_id": "GHSA-jr9j-g3xj-q9x8",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Hard-coded signing keys in auth-framework",
  "summary": "Affected auth-framework releases can use publicly known built-in secrets for JARM, JWT introspection, or default SAML processing. An attacker may forge signed authorization or introspection data, or SAML tokens, that an application accepts when it relies on the affected key configuration or defaults. Material issued under those keys should be considered untrustworthy.",
  "mitigation": "Upgrade to 0.4.29, 0.5.0-rc51, or 0.6.0-rc85, as appropriate for your release line, and explicitly configure application-controlled signing keys and secrets. Rotate affected secrets and revoke or revalidate tokens and sessions issued under the prior configuration.",
  "vendor": "rust",
  "product": "rust:auth-framework",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.4.0, < 0.4.29"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "0.4.29"
      ],
      "package_name": "auth-framework",
      "purl": "pkg:cargo/auth-framework"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.5.0-rc1, < 0.5.0-rc51"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "0.5.0-rc51"
      ],
      "package_name": "auth-framework",
      "purl": "pkg:cargo/auth-framework"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.6.0-rc41, < 0.6.0-rc85"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "0.6.0-rc85"
      ],
      "package_name": "auth-framework",
      "purl": "pkg:cargo/auth-framework"
    }
  ],
  "cwes": [
    321
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.04770775,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T00:24:57+00:00",
      "days": -3.1328664917939815,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T03:36:16.724085+00:00",
      "url": "https://github.com/ciresnave/auth-framework/security/advisories/GHSA-jr9j-g3xj-q9x8"
    }
  }
}