Authentication Tag Forgery in jose by Potatosalad Due to AES-GCM Fallback

CVE-2026-65625

What is CVE-2026-65625?

The jose library contains an authentication tag forgery vulnerability due to the AES-GCM fallback mechanism. In the decryption process, the library derives the number of verified authentication tag bits from an attacker-controlled tag without checking its length. This allows attackers to truncate the tag to as few as 8 bits, significantly reducing the system's forgery resistance. Consequently, a forged ciphertext can be accepted as authentic with minimal attempts, posing severe risks to applications relying on JWE tokens. Furthermore, longer tags cause crashes, thus affecting application stability when using older or restricted versions of Erlang.

References