CVE-2026-84185
Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
- Record
CVE-2026-84185- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-06
EUVDEUVD-2026-70747
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
- Record
EUVD-2026-70747- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-06
NVD
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
- Record
CVE-2026-84185- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-84185
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
- Record
DEBIAN-CVE-2026-84185- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-84185
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
- Record
UBUNTU-CVE-2026-84185- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11712-1 No score
python313-jwcrypto-1.6.0-1.1 on GA media
These are all security issues fixed in the python313-jwcrypto-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11712-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21827-1 No score
Security update for python-jwcrypto
This update for python-jwcrypto fixes the following issues:
- CVE-2026-80179: denial of service via malformed JWE tokens (bsc#1277639).
- CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification (bsc#1278707).
- Record
openSUSE-SU-2026:21827-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23702-1 No score
Security update for python-jwcrypto
This update for python-jwcrypto fixes the following issues:
- CVE-2026-80179: denial of service via malformed JWE tokens (bsc#1277639).
- CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification (bsc#1278707).
- Record
SUSE-SU-2026:23702-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23722-1 No score
Security update for python-jwcrypto
This update for python-jwcrypto fixes the following issues:
- CVE-2026-80179: denial of service via malformed JWE tokens (bsc#1277639).
- CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification (bsc#1278707).
- Record
SUSE-SU-2026:23722-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-jwcryptoDebian:13 |
All versions, plus listed versions 1.5.6-11.5.6-1.11.5.6-1.1~deb13u11.5.6-1.2 |
None known |
python-jwcryptoDebian:14 |
All versions, plus listed versions 1.5.6-11.5.6-1.11.5.6-1.1~deb13u11.5.6-1.2 |
None known |
python-jwcryptoSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 1.5.6-160000.4.1 | 1.5.6-160000.4.1 |
python-jwcryptoSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 1.5.6-160000.4.1 | 1.5.6-160000.4.1 |
python-jwcryptoUbuntu:16.04:LTS |
All versions, plus listed versions 0.2.1-1 |
None known |
python-jwcryptoUbuntu:18.04:LTS |
All versions, plus listed versions 0.3.2-10.4.2-1 |
None known |
python-jwcryptoUbuntu:20.04:LTS |
All versions, plus listed versions 0.6.0-10.6.0-2 |
None known |
python-jwcryptoUbuntu:22.04:LTS |
All versions, plus listed versions 0.8.0-11.0.0-2 |
None known |
python-jwcryptoUbuntu:24.04:LTS |
All versions, plus listed versions 1.1.0-11.5.4-1 |
None known |
python-jwcryptoUbuntu:26.10 |
All versions, plus listed versions 1.5.6-11.5.6-1.11.5.6-1.2 |
None known |
python-jwcryptoUbuntu:26.04:LTS |
All versions, plus listed versions 1.5.6-1 |
None known |
python-jwcryptoopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.6.0-1.1 | 1.6.0-1.1 |
python-jwcryptoopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 1.5.6-160000.4.1 | 1.5.6-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84185 is a medium vulnerability (CVSS 5.9) in Red Hat Ansible Automation Platform 2, published September 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.