CVE-2026-102946 Details
Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
A vulnerability exists in the joserfc library, specifically in the JWS deserialization function for General JSON Serialization. Prior to version 1.7.4, the function incorrectly accepted JWS payloads with empty signatures as validly authenticated. This flaw allows an attacker to manipulate payloads, bypassing signature verification entirely. The issue is not present in Compact JWS, JWT decoding, Flattened JSON serialization, or JWE JSON processing.
Users can upgrade to joserfc version 1.7.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe | [email protected] | Source CodeVendor |
| https://github.com/authlib/joserfc/releases/tag/1.7.4 | [email protected] | Release NotesVendor |
| https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib joserfc | 1.7.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |