[GHSA-66cv-5wq4-p78m] Add finder credit and affected package range (CVE-2026-81829)

[ByteHackr]

Adds a credits entry crediting Sandipan Roy (@ByteHackr) as FINDER, and fills in the empty affected field with a verified Maven package range, plus supporting references.

1. Finder credit

Public evidence supporting this credit:

• The CVE record published by the Red Hat CNA lists the credit: "This issue was discovered by Sandipan Roy (Red Hat)." — https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/81xxx/CVE-2026-81829.json
• Red Hat Bugzilla #2524980 (CVE-2026-81829) was created by Sandipan Roy (Bugzilla REST API creator field: "Sandipan Roy", account saroy)
• The repository security advisory for the same CVE, GHSA-7x9g-wc63-whmg, already credits the finder (GHSA-7x9g-wc63-whmg)

The credits structure follows the OSV schema and the convention already used in this repository (e.g. merged PR #7190).

2. Affected package range

affected was empty; populated with io.smallrye:smallrye-jwt (Maven), range >= 4.3.0, < 4.6.4 — all versions verified against upstream sources:

• Introduced in 4.3.0: the vulnerable class io.smallrye.jwt.auth.principal.AwsAlbKeyResolver was added by Support AWS ALB token verification smallrye/smallrye-jwt#707 (merged 2023-07-04); release 4.3.0 published 2023-07-05. Verified: class present at tag 4.3.0, absent at tag 4.2.1.
• Fixed in 4.6.4: Sanitize AwsAlbKeyResolver kid smallrye/smallrye-jwt#925 ("Sanitize AwsAlbKeyResolver kid", adds SAFE_KID regex validation) merged 2026-09-17T14:30Z; release 4.6.4 published 2026-09-17T14:48Z (18 minutes later). Class present unfixed at tag 4.6.3.
• Added WEB references for the fix PR and the patched release.

These coordinates align this entry with repository security advisory GHSA-7x9g-wc63-whmg for the same CVE.

---

Per CONTRIBUTING.md this PR touches exactly one advisory. Happy to adjust the range or details as the curation team sees fit — and if appropriate, would this advisory be a candidate for review given the package mapping and existing RSA for the same CVE? Thanks!

[ByteHackr]

Thanks! Aside from the credit, would the curation team be able to consider this advisory for review (i.e., upgrade it from the NVD mirror entry to a reviewed advisory)? Note that a repository security advisory for this vulnerability already exists in smallrye/smallrye-jwt (GHSA-7x9g-wc63-whmg, published by the maintainer), and this database entry affects Maven ecosystem packages (io.smallrye:smallrye-jwt, quarkus-smallrye-jwt). Happy to help with any additional information to make the review possible.

[ByteHackr]

Updating this PR with the affected package range so the advisory can be considered for review. All versions verified against upstream sources:

Affected package: io.smallrye:smallrye-jwt (Maven) — artifact containing the vulnerable AwsAlbKeyResolver class.

Affected range: >= 4.3.0, < 4.6.4 — evidence:

• Introduced in 4.3.0 (released 2023-07-05): the vulnerable class io.smallrye.jwt.auth.principal.AwsAlbKeyResolver was added by PR Support AWS ALB token verification smallrye/smallrye-jwt#707 (2023-07-04). Verified: class exists at tag 4.3.0 (HTTP 200), absent at tag 4.2.1 (HTTP 404).
• Fixed in 4.6.4: PR Sanitize AwsAlbKeyResolver kid smallrye/smallrye-jwt#925 ("Sanitize AwsAlbKeyResolver kid", adds SAFE_KID regex validation rejecting unsafe kid values) merged 2026-09-17T14:30Z, and release 4.6.4 was published at 2026-09-17T14:48Z — 18 minutes later. Class exists unfixed at tag 4.6.3.

Also added WEB references for the fix PR and the patched release. These coordinates should align this entry with repository security advisory GHSA-7x9g-wc63-whmg for the same CVE.