CVE-2026-84185

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-03

Last updated on: 2026-09-08

Assigner: redhat-SADP

Description

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-08

Generated

2026-10-14

AI Q&A

2026-09-04

EPSS Evaluated

2026-10-13

NVD

CVE-2026-84185

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Ansible Automation Platform 2 *
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the jwcrypto library, which handles JSON Object Signing and Encryption (JOSE) standards. It occurs when verifying a JSON Web Signature (JWS) using multiple keys. The library fails to correctly match the key ID (kid) and may accept a signature from any valid key in the set, allowing unauthorized access.

Detection Guidance

To detect this vulnerability, inspect applications using the jwcrypto library for improper key ID (kid) validation in JWS verification. Check if the library accepts signatures from any valid key instead of the specified kid. Review logs for unauthorized access attempts that bypass tenant or user isolation.

Impact Analysis

An attacker with a valid key could bypass authorization checks in applications relying on key IDs to identify users or tenants. This may lead to unauthorized access to sensitive data or actions, depending on the application's use of the library.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data. If an attacker bypasses authorization checks using a valid key, they may gain access to protected information, violating data protection requirements under these regulations.

Mitigation Strategies

Update the jwcrypto library to the latest version that fixes this issue. Review applications using the library to ensure they properly validate key IDs and do not rely solely on signature verification for authorization.

Hi! I’m here to help you understand CVE-2026-84185. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70