CVE-2026-102946

Deferred Deferred - Pending Action

Authentication Bypass in joserfc via Empty Signatures Array

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102946

EUVD

EUVD-2026-102310

Affected Vendors & Products

Vendor	Product	Version / Range
authlib	joserfc	< 1.7.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

joserfc is a Python library for JOSE standards. Prior to version 1.7.4, the joserfc.jws.deserialize_json() function incorrectly accepted a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() function would return success without performing any signature checks because the loop did not run on an empty array. This allowed attackers to forge messages with arbitrary payloads without a signing key.

Detection Guidance

To detect this vulnerability, check if your system uses joserfc versions prior to 1.7.4. Run: pip show joserfc to verify the installed version. If vulnerable, inspect applications using deserialize_json() for improper signature validation on JWS General JSON Serialization with empty signatures arrays.

Impact Analysis

This vulnerability allows attackers to bypass signature verification and forge messages or tokens. Applications relying on joserfc for authenticity checks, such as signed documents or webhooks, may treat forged payloads as legitimate. This could lead to unauthorized actions, data tampering, or impersonation if exploited.

Compliance Impact

This vulnerability undermines integrity and authenticity controls required by GDPR, HIPAA, and other regulations. Forged signed data could violate non-repudiation and data integrity principles, leading to compliance violations, legal risks, and potential data breaches if exploited.

Mitigation Strategies

Immediately upgrade joserfc to version 1.7.4 or later using pip install --upgrade joserfc. Review and update any code using deserialize_json() to ensure proper signature validation. Monitor for unusual activity in systems processing JWS data.

Hi! I’m here to help you understand CVE-2026-102946. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70