CVE-2026-89086
Received Received - Intake

RSA Signature Validation Bypass in OCaml jose Library

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MITRE

Description
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-89086
EUVD
EUVD-2026-75708

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ulrikstrid jose to 0.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the jose package before 0.11.0 for OCaml involves improper RSA signature validation. The library only checks if PKCS #1 decoding succeeds but fails to perform required steps involving the public key to confirm the signature's validity. This allows attackers to forge signatures without proper verification.

Impact Analysis

This vulnerability can lead to serious security risks such as unauthorized access, data tampering, or impersonation attacks. Attackers could exploit it to bypass authentication mechanisms, manipulate data, or gain elevated privileges in systems relying on the jose library for RSA signature verification.

Compliance Impact

This vulnerability can undermine compliance with GDPR, HIPAA, and other regulations by compromising data integrity and security. It may lead to unauthorized data access or modification, violating confidentiality and integrity requirements mandated by these standards.

Mitigation Strategies

Update the jose package to version 0.11.0 or later to ensure proper RSA signature validation. Verify that all library calls using the jose package implement the corrected verification logic as described in the commit.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89086. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart