JSON Object Signing and Encryption Vulnerability in joserfc Python Library
CVE-2026-102946

9.1CRITICAL

Key Information:

Vendor

Authlib

Status
Joserfc
Vendor
CVE Published:
15 October 2026

What is CVE-2026-102946?

The joserfc library, which implements JSON Object Signing and Encryption standards, contains a vulnerability where the deserialization method for JWS General JSON Serialization accepts an empty signatures array as valid. This flaw allows attackers to bypass signature checks, thus enabling them to submit arbitrary payloads that could be treated as authentic by applications relying on this library. The issue is limited to the General JSON Serialization path and does not affect other serialization methods. Users are advised to upgrade to version 1.7.4 or later to mitigate this vulnerability.

Affected Version(s)

joserfc < 1.7.4

References

https://github.com/authlib/joserfc/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/authlib/joserfc/commit/f409f8f058225d7...
x_refsource_MISC
https://github.com/authlib/joserfc/releases/tag/1.7.4
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.