CVE-2026-49852 Details
Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign and HMACAlgorithm.verify in src/joserfc/_rfc7518/jws_algs.py pass the output of OctKey.get_op_key(...) to hmac.new(...) and OctKey.import_key in src/joserfc/_rfc7518/oct_key.py only emits a SecurityWarning for keys shorter than 14 bytes without rejecting zero-length input. This issue is fixed in version 1.6.8.
A vulnerability in the joserfc library's JWT decoding process allows for the acceptance of forged HMAC-signed tokens. This issue arises when the verification key provided by the caller is either an empty string or None. The vulnerability exists in versions of joserfc prior to 1.6.8. The problem stems from the fact that the library's handling of OctKey verification keys does not properly reject empty inputs, enabling attackers to create valid signatures without any secret knowledge. This flaw can be exploited in any application that uses joserfc for JWT handling and has a misconfigured secret key.
Users are advised to upgrade to joserfc version 1.6.8 or later, where this vulnerability has been addressed by implementing proper checks to reject empty HMAC keys during the signing and verification processes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1 | [email protected] | Source CodeVendor |
| https://github.com/authlib/joserfc/releases/tag/1.6.8 | [email protected] | Release NotesVendor |
| https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1391 | Use of Weak Credentials | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-326 | Inadequate Encryption Strength | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib joserfc | <= 1.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |