Password Hash Vulnerability in jose Library by Potatosalad

CVE-2026-65629

What is CVE-2026-65629?

The jose library has a vulnerability related to password encryption, where exported private keys can be attacked offline due to the use of suboptimal password hashing techniques. The library employs a PBKDF2 scheme with only 2048 iterations and a short 64-bit random salt, which is significantly below current security standards. This insufficient key-stretching allows attackers who access the password-encrypted private-key export to mount inexpensive dictionary or brute-force attacks, potentially compromising the full private key. Affected versions are from jose 1.10.0 but less than 1.11.13, making it important for users to upgrade to the latest version for mitigation.

References