Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign and HMACAlgorithm.verify in src/joserfc/_rfc7518/jws_algs.py pass the output of OctKey.get_op_key(...) to hmac.new(...) and OctKey.import_key in src/joserfc/_rfc7518/oct_key.py only emits a SecurityWarning for keys shorter than 14 bytes without rejecting zero-length input. This issue is fixed in version 1.6.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| authlib | joserfc | < 1.6.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | joserfc | 1.6.8-1 | — |
| Debian 13 | joserfc | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | joserfc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | jaeger | 2.19.0-1.2.hum1 | RHSA-2026:42045 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-joserfc | 1.7.2-2.1 | openSUSE-SU-2026:11183-1 |
| openSUSE Leap 16.0 | python-joserfc | 1.1.0-bp160.3.1 | openSUSE-SU-2026:21263-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.2-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | joserfc | < 1.6.8 | 1.6.8 | GHSA-gg9x-qcx2-xmrh |
Advisories 3
- RHSA-2026:42045 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:21263-1 Security update for python-joserfc SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:11183-1 python313-joserfc-1.7.2-2.1 on GA media SUSE / openSUSE Security Updates · Jul 5, 2026