CVE-2026-102946— joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
Quick assessment
Affected
authlib joserfc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
joserfc 是一个 Python 库，提供了多种 JSON 对象签名与加密（JOSE）标准的实现。在版本 1.7.4 之前， 函数会将带有空 signatures 数组的 JWS 通用 JSON 序列化合视为已通过身份验证。 函数在处理空数组时不会执行任何迭代，并因“没有签名验证失败”而返回成功，这使得攻击者无需拥有签名密钥即可提供任意载荷，而依赖该载荷的应用程序可能将其视为真实有效的内容。该问题仅影响通用 JSON 序列化路径；紧凑格式 JWS 和 JWT 解码、扁平化 JSON 序列化以及 JWE JSON
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102946
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
Source: CVE Program / CVE List V5
Vulnerability Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-102946
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102946
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-102946 (1)
Vendor Advisories for CVE-2026-102946 (1)
Other References for CVE-2026-102946 (1)
-
🔗 Release 1.7.4 · authlib/joserfc · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: joserfc
-
CVE-2026-75509
joserfc claim-validation bypass via array-typed single-strin -
CVE-2026-62995
joserfc accepts JWT with padding, leading to JWT malleabilit -
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key -
CVE-2026-48990
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry p -
CVE-2026-27932
joserfc PBES2 p2c Unbounded Iteration Count enables Denial o
Same vendor: authlib
-
CVE-2026-104056
CVE-2026-104056 -
CVE-2026-96760
Authlib library contains a signature‑verification bypass vul -
CVE-2026-75509
joserfc claim-validation bypass via array-typed single-strin -
CVE-2026-62995
joserfc accepts JWT with padding, leading to JWT malleabilit -
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key
Same weakness: CWE-290
-
CVE-2026-102764
Improper Origin Validation in Internal Messaging Components -
CVE-2026-110723
api-gateway 1.7.3及以下版本速率限制绕过漏洞 -
CVE-2026-57489
FileRise: AUTH_BYPASS reverse-proxy header trust without sou -
CVE-2026-110768
holaOS through 2026.822.1 Authorization Bypass via Telegram -
CVE-2026-106465
NetX Secure DTLS服务器存在绕过验证漏洞
V. Comments for CVE-2026-102946
No comments yet