Skip to content
OpenAdvisories

Product · authlib

joserfc

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-119284

    joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. Wh…

    authlib joserfc joserfc joserfc Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2026-75509

    joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss t…

    authlib joserfc joserfc joserfc Debian Ubuntu
  • Medium 5.3
    CVE-2026-48990

    joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_leng…

    authlib joserfc joserfc joserfc Debian Ubuntu PyPI