CVE-2026-75509: fallo de gravedad media en authlib joserfc
joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.1%
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Productos afectados
authlib · joserfcCVEs relacionadas — authlib joserfc
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-27932HIGHjoserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)EPSS 0.5%CVE-2025-65015CRITICALjoserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token PayloadsEPSS 0.4%CVE-2026-48990MEDIUMjoserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserializationEPSS 0.2%CVE-2026-119283HIGHjoserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionEPSS 0.2%CVE-2026-119284MEDIUMjoserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionEPSS 0.2%CVE-2026-49852HIGHjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)EPSS 0.2%