Malleability Vulnerability in joserfc Library Impacting JSON Object Signing and Encryption
CVE-2026-62995

2.3LOW

Key Information:

Vendor

Authlib

Status
Joserfc
Vendor
CVE Published:
29 July 2026

What is CVE-2026-62995?

The joserfc library, a Python implementation of JSON Object Signing and Encryption (JOSE) standards, contains a vulnerability in versions 1.7.1 and earlier. It improperly accepts JWTs with trailing padding, which diverges from JOSE specifications. This acceptance allows for malleability in the JWTs processed by joserfc, potentially undermining the effectiveness of token revocation mechanisms or anti-replay protections that rely on deny lists of tokens or hashes. While ECDSA JWS signatures are inherently malleable, other signature or MAC schemes may falsely assume non-malleability, resulting in security vulnerabilities. The issue has been resolved in version 1.7.2.

Affected Version(s)

joserfc < 1.7.2

References

https://github.com/authlib/joserfc/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.