Read the docs
TI-2026-74876 Aliases CVE-2026-102946

Signature verification bypass in joserfc JWS deserialization

Priority HIGH 80CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-290.

Summary

The authlib joserfc Python library before 1.7.4 accepts a JWS General JSON Serialization with an empty signatures array as authenticated. Improper verification of a cryptographic signature (CWE-347) occurs because the verification loop performs no checks on an empty array and reports success. An unauthenticated remote attacker without a signing key can supply an arbitrary payload that relying applications may treat as authentic. Compact JWS, JWT decoding, Flattened JSON serialization and JWE JSON processing are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00117 1st percentileScored 2026-11-07
Fix Partial joserfc (authlib): 1.7.4Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
authlibjoserfcbefore 1.7.41.7.4Patch availableCNA
  • joserfc Vendorauthlib Affected before 1.7.4 Fixed in 1.7.4 Patch available CNA

Remediation

Update joserfc to version 1.7.4. Red Hat fixes Red Hat Satellite 6.18 and 6.19 through RHSA-2026:92667 and RHSA-2026:92666. Red Hat lists Lightspeed Core, Migration Toolkit for Applications 8, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux command line assistant and Red Hat OpenShift Virtualization 4 as affected with no fix available, and OpenShift Lightspeed with no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA joserfc (authlib) Fixed in 1.7.4

Red Hat 2 advisories

  • RHSA-2026:92667 Released 2026-10-29 · Red Hat rating Critical
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:92666 Released 2026-10-29 · Red Hat rating Critical
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/foreman-mcp-server-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift LightspeedAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux command line assistantAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Satellite 6.18Fixed RHSA-2026:92667
Red Hat Satellite 6.19Fixed RHSA-2026:92666
Not affected: 1 product
  • Exploit Intelligence

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-102946
  2. 2026-10-16 Affected versions changed · Red Hat
  3. 2026-10-16 CVSS score added · Red Hat
  4. 2026-10-18 Affected versions changed · Red Hat
  5. 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
  6. 2026-10-31 Fix available: RHSA-2026:92666 · Red Hat
  7. 2026-10-31 Fix available: RHSA-2026:92667 · Red Hat
  8. 2026-11-06 Affected versions changed · Red Hat

References

Other 3

  • TI-2026-65772 Insufficient verification of data authenticity in Authlib CVSS 3.1CRITICAL 9.8
  • TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
  • TI-2025-40202 Resource allocation without limits in authlib joserfc CVSS 4.0CRITICAL 9.2
  • TI-2026-36756 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVSS 4.0HIGH 8.7
  • TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
  • TI-2026-82772 Uncontrolled resource consumption in authlib joserfc CVSS 3.1HIGH 7.5
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences