CVE-2026-75509— joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
Quick assessment
Affected
authlib joserfc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
joserfc 是一个 Python 库，提供了多种 JSON 对象签名和加密（JOSE）标准的实现。在 1.7.3 版本之前， 对 （签发者）和 （主体）这两个具有列表值的声明进行了成员匹配检查。这意味着，如果 是一个数组，且该数组中包含预期的签发者，则能够通过原本期望进行相等性比较的验证，从而导致签发者验证可以被绕过。此问题已在 1.7.3 版本中得到修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75509
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
Source: CVE Program / CVE List V5
Vulnerability Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-75509
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75509
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-75509 (1)
Vendor Advisories for CVE-2026-75509 (1)
IV. Related Vulnerabilities
Same product: joserfc
-
CVE-2026-62995
joserfc accepts JWT with padding, leading to JWT malleabilit -
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key -
CVE-2026-48990
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry p -
CVE-2026-27932
joserfc PBES2 p2c Unbounded Iteration Count enables Denial o -
CVE-2025-65015
joserfc has Possible Uncontrolled Resource Consumption Vulne
Same vendor: authlib
-
CVE-2026-62995
joserfc accepts JWT with padding, leading to JWT malleabilit -
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key -
CVE-2026-41479
Authlib OAuth 2.0 authorization endpoint open redirects to a -
CVE-2026-48990
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry p -
CVE-2026-44681
Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Autho
Same weakness: CWE-290
-
CVE-2026-80349
TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-F -
CVE-2026-19538
Bypass of BLOCKED ACL items on proxy protocol port over TCP -
CVE-2026-75037
Polkit authentication bypass in LACT -
CVE-2026-77337
CakePHP: Potential Authentication bypass with CookieAuthenti -
CVE-2026-76835
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via
V. Comments for CVE-2026-75509
No comments yet