Skip to content
OpenAdvisories

Package · Pub

jose

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    CVE-2026-34240

    jose vulnerable to untrusted JWK header key acceptance during signature verification

    JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerabil…

    appsup-dart jose jose Pub