Every CVE Search/ Get API key

CVE-2026-102946

joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

9.1 CriticalFix available

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.12%Unchanged since Oct 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Record
CVE-2026-102946
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-290, CWE-345, CWE-347
Updated
2026-11-02
EUVDEUVD-2026-102310 9.1

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Record
EUVD-2026-102310
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
NVD 9.1

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Record
CVE-2026-102946
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-290, CWE-345, CWE-347
Updated
2026-11-02
OSV 9.1

joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Record
CVE-2026-102946
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-290, CWE-345, CWE-347
Updated
2026-11-02
OSVDEBIAN-CVE-2026-102946 9.1

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Record
DEBIAN-CVE-2026-102946
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-102946 9.1

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

Record
UBUNTU-CVE-2026-102946
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:12204-1 No score

python313-joserfc-1.7.7-1.1 on GA media

These are all security issues fixed in the python313-joserfc-1.7.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12204-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22136-1 No score

Security update for python-joserfc

This update for python-joserfc fixes the following issues:

Changes in python-joserfc:

  • CVE-2026-102946: JWS signature verification can be bypassed via empty signatures array (bsc#1285840)
Record
openSUSE-SU-2026:22136-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
joserfc
Debian:13
 All versions, plus listed versions
1.1.0-11.2.0-11.2.2-11.3.1-11.3.2-1
Show 18 moreShow less
1.3.4-11.4.0-11.4.1-11.4.3-11.5.0-11.6.0-11.6.1-11.6.2-11.6.3-11.6.4-11.6.5-11.6.8-11.7.0-11.7.1-11.7.2-11.7.3-11.7.4-11.7.5-1
 None known
joserfc
Debian:14
 before 1.7.4-1, plus listed versions
1.1.0-11.2.0-11.2.2-11.3.1-11.3.2-1
Show 16 moreShow less
1.3.4-11.4.0-11.4.1-11.4.3-11.5.0-11.6.0-11.6.1-11.6.2-11.6.3-11.6.4-11.6.5-11.6.8-11.7.0-11.7.1-11.7.2-11.7.3-1
1.7.4-1
joserfc
Ubuntu:26.10
 All versions, plus listed versions
1.6.2-11.6.5-11.6.8-11.7.0-11.7.1-11.7.2-11.7.4-1
 None known
joserfc
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.2-11.4.0-11.4.1-11.4.3-11.5.0-11.6.2-1
 None known
python-joserfc
openSUSE:Tumbleweed
 before 1.7.7-1.1
1.7.7-1.1
python-joserfc
openSUSE:Leap 16.0
 before 1.1.0-bp160.5.1
1.1.0-bp160.5.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102946 is a critical vulnerability (CVSS 9.1) in Authlib Joserfc, published October 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in joserfc 1.7.4-1.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open