CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign and HMACAlgorithm.verify in src/joserfc/_rfc7518/jws_algs.py pass the output of OctKey.get_op_key(...) to hmac.new(...) and OctKey.import_key in src/joserfc/_rfc7518/oct_key.py only emits a SecurityWarning for keys shorter than 14 bytes without rejecting zero-length input. This issue is fixed in version 1.6.8.

CVSS

No CVSS.

References

Link	Resource
https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1
https://github.com/authlib/joserfc/releases/tag/1.6.8
https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh
https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) joserfc es una biblioteca de Python que proporciona una implementación de varios estándares de Firma y Cifrado de Objetos JSON (JOSE). Antes de la versión 1.6.8, joserfc.jwt.decode acepta tokens firmados con HMAC forjados por el atacante cuando la clave de verificación proporcionada por el llamador es una cadena vacía o None, porque HMACAlgorithm.sign y HMACAlgorithm.verify en src/joserfc/_rfc7518/jws_algs.py pasan la salida de OctKey.get_op_key(...) a hmac.new(...) y OctKey.import_key en src/joserfc/_rfc7518/oct_key.py solo emite una SecurityWarning para claves de menos de 14 bytes sin rechazar entradas de longitud cero. Este problema se solucionó en la versión 1.6.8.

Information

Published : 2026-07-17 20:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-49852

Mitre link : CVE-2026-49852

CVE.ORG link : CVE-2026-49852

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-326

Inadequate Encryption Strength

CWE-1391

Use of Weak Credentials

{"id": "CVE-2026-49852", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49852", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T14:58:30.595996Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "authlib", "product": "joserfc", "versions": [{"status": "affected", "version": "< 1.6.8"}]}]}], "published": "2026-07-17T20:17:23.270", "references": [{"url": "https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1", "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/releases/tag/1.6.8", "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh", "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-326"}, {"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign and HMACAlgorithm.verify in src/joserfc/_rfc7518/jws_algs.py pass the output of OctKey.get_op_key(...) to hmac.new(...) and OctKey.import_key in src/joserfc/_rfc7518/oct_key.py only emits a SecurityWarning for keys shorter than 14 bytes without rejecting zero-length input. This issue is fixed in version 1.6.8."}, {"lang": "es", "value": "joserfc es una biblioteca de Python que proporciona una implementaci\u00f3n de varios est\u00e1ndares de Firma y Cifrado de Objetos JSON (JOSE). Antes de la versi\u00f3n 1.6.8, joserfc.jwt.decode acepta tokens firmados con HMAC forjados por el atacante cuando la clave de verificaci\u00f3n proporcionada por el llamador es una cadena vac\u00eda o None, porque HMACAlgorithm.sign y HMACAlgorithm.verify en src/joserfc/_rfc7518/jws_algs.py pasan la salida de OctKey.get_op_key(...) a hmac.new(...) y OctKey.import_key en src/joserfc/_rfc7518/oct_key.py solo emite una SecurityWarning para claves de menos de 14 bytes sin rechazar entradas de longitud cero. Este problema se solucion\u00f3 en la versi\u00f3n 1.6.8."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}