Authentication Bypass in jwcrypto via Key ID Confusion

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-84185

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the jwcrypto library, which handles JSON Object Signing and Encryption (JOSE) standards. It occurs when verifying a JSON Web Signature (JWS) using multiple keys. The library fails to correctly match the key ID (kid) and may accept a signature from any valid key in the set, allowing unauthorized access.

Impact Analysis

An attacker with a valid key could bypass authorization checks in applications relying on key IDs to identify users or tenants. This may lead to unauthorized access to sensitive data or actions, depending on the application's use of the library.

Mitigation Strategies

Update the jwcrypto library to the latest version that fixes this issue. Review applications using the library to ensure they properly validate key IDs and do not rely solely on signature verification for authorization.

Hi! I’m here to help you understand CVE-2026-84185. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70