# JWTKit 5.8.0 Security Update

**URL:** <https://forums.swift.org/t/jwtkit-5-8-0-security-update/90321>\
**Category:** Security Updates\
**Created:** [October 28, 2026, 11:45pm UTC](https://forums.swift.org/t/jwtkit-5-8-0-security-update/90321 "2026-10-28T23:45:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![0xTim](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/0xtim/32/27968_2.png) [@0xTim](https://forums.swift.org/u/0xTim)\
**Post date:** [October 28, 2026, 11:45pm UTC](https://forums.swift.org/t/jwtkit-5-8-0-security-update/90321/1 "2026-10-28T23:45:00Z")

</div>

We've just released [JWTKit 5.8.0](https://github.com/vapor/jwt-kit/releases/tag/5.8.0) and [JWT 5.2.0](https://github.com/vapor/jwt/releases/tag/5.2.0) which contain a number of security fixes discovered from external reporters and fuzzing. We recommend that you update as soon as possible.

If your application uses provider identity tokens for login, you may also need to configure an expected client or project ID, or migrate to the new audience-aware verification APIs. Updating alone does not secure login paths that continue to accept tokens without checking their audience.

See more information on the [blog post](https://blog.vapor.codes/posts/jwt-kit-5-8-0/)