TI-2026-52874 Aliases CVE-2026-75509

joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

MEDIUM 62CWE-290Published 2026-08-24 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: Partial Red Hat: 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-290.

Summary

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00124 2nd percentileScored 2026-11-07

Fix Partial joserfc (authlib): 1.7.3Red Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
authlib	joserfc	before 1.7.3	1.7.3	Patch available	CNA

joserfc Vendorauthlib Affected before 1.7.3 Fixed in 1.7.3 Patch available CNA

Remediation

Fix · CNA joserfc (authlib) Fixed in 1.7.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Lightspeed Core	Affected	No fix yet: Fix deferred
Migration Toolkit for Applications 8	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux command line assistant	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-75509

References

Other 2

TI-2026-65772 Insufficient verification of data authenticity in Authlib CVSS 3.1CRITICAL 9.8
TI-2026-74876 Signature verification bypass in joserfc JWS deserialization CVSS 3.1CRITICAL 9.1
TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
TI-2025-40202 Resource allocation without limits in authlib joserfc CVSS 4.0CRITICAL 9.2
TI-2026-36756 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVSS 4.0HIGH 8.7
TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences