CVE-2026-102946

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102946", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T20:24:43.341Z", "datePublished": "2026-10-15T18:28:06.913Z", "dateUpdated": "2026-10-15T19:53:09.069Z"}, "containers": {"cna": {"title": "joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"}, {"name": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe"}, {"name": "https://github.com/authlib/joserfc/releases/tag/1.7.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/releases/tag/1.7.4"}], "affected": [{"vendor": "authlib", "product": "joserfc", "versions": [{"version": "< 1.7.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-15T18:28:06.913Z"}, "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4."}], "source": {"advisory": "GHSA-4pp3-559j-c5c2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T19:52:38.661517Z", "id": "CVE-2026-102946", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T19:53:09.069Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102946", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T20:24:43.341Z", "datePublished": "2026-10-15T18:28:06.913Z", "dateUpdated": "2026-10-15T19:53:09.069Z"}, "containers": {"cna": {"title": "joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"}, {"name": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe"}, {"name": "https://github.com/authlib/joserfc/releases/tag/1.7.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/releases/tag/1.7.4"}], "affected": [{"vendor": "authlib", "product": "joserfc", "versions": [{"version": "< 1.7.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-15T18:28:06.913Z"}, "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4."}], "source": {"advisory": "GHSA-4pp3-559j-c5c2", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102946", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T19:52:38.661517Z"}}}], "references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T19:52:50.967Z"}}]}}

{"affected": [{"affectedData": [{"product": "joserfc", "vendor": "authlib", "versions": [{"status": "affected", "version": "< 1.7.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4."}], "id": "CVE-2026-102946", "lastModified": "2026-10-15T20:17:05.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102946", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T19:52:38.661517Z", "version": "2.0.3"}}]}, "published": "2026-10-15T19:17:13.423", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe"}, {"source": "security-advisories@github.com", "url": "https://github.com/authlib/joserfc/releases/tag/1.7.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "joserfc: joserfc: Signature verification bypass via empty signatures array", "id": "2553667", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553667"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.", "A flaw was found in joserfc. When processing a JSON Web Signature (JWS) in General JSON Serialization format, the library improperly treats tokens containing an empty signatures list as valid. A remote attacker without a valid signing key can exploit this flaw by submitting an arbitrary payload with an empty signatures array, bypassing signature verification and causing applications to treat untrusted data as authentic."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-102946", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Not affected", "package_name": "exploit-intelligence/vulnerability-analysis-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Affected", "package_name": "lightspeed-core/lightspeed-stack-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Affected", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed:1", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:rhel_cla:1", "fix_state": "Affected", "package_name": "rhel-cla/rhel-knowledge-bridge-rhel10", "product_name": "Red Hat Enterprise Linux command line assistant"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "container-native-virtualization/ocp-virt-validation-checkup-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/foreman-mcp-server-rhel9", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-15T18:28:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102946\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102946\nhttps://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe\nhttps://github.com/authlib/joserfc/releases/tag/1.7.4\nhttps://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"], "statement": "This vulnerability is rated as having Critical impact because it permits an unauthenticated remote attacker to completely bypass cryptographic verification without possessing valid signing keys, compromising data integrity and trust. By presenting crafted objects omitting cryptographic signatures, callers parsing general serializations mistakenly treat fabricated payloads as authentic. Exposure is limited to application workflows utilizing the general JSON serialization mechanism, while standard compact token decodings such as JSON Web Tokens (JWT) are not susceptible.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "joserfc", "source": "cna", "vendor": "authlib"}, "product": "joserfc", "vendor": "authlib"}], "created": "2026-10-16T17:45:14.081093+00:00", "updated": "2026-10-23T13:15:14.107157+00:00", "vendors": ["authlib", "authlib$PRODUCT$joserfc"]}