CVE-2026-75509
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
joserfc, a Python library implementing JOSE standards, prior to version 1.7.3, has a vulnerability in JWTClaimsRegistry that applies membership matching to list-valued iss and sub claims, allowing an array-valued iss containing the expected issuer to pass an intended equality check and enabling issuer-validation bypass.
Risk Assessment
The risk is that JWT validation can be bypassed, potentially leading to unauthorized access to systems or services.
Recommendation
Upgrade joserfc to version 1.7.3 or later.
Other vulnerabilities in joserfc
See all- CVE-2026-62995Low
The Python library joserfc versions 1.7.1 and earlier accept JWTs with trailing padding (==), which is non-conforming to JOSE specifications. This leads to token malleability, potentially allowing bypass of token revocation or anti-replay protection.
- CVE-2026-49852High
Vulnerability in the joserfc Python library before version 1.6.8 allows an attacker to forge HMAC tokens when the verification key is an empty string or None. The library does not reject zero-length keys, allowing signature verification bypass.
- CVE-2026-48990Medium
The joserfc library in versions 1.3.4 through 1.6.5 accepts oversized JWS payloads without proper length checks, potentially leading to resource exhaustion. This issue has been fixed in version 1.6.7.
Original NVD description (English source)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.