All 6 CVE vulnerabilities found in joserfc, with AI-generated Chinese analysis, references, and POCs.
Vendor: authlib
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-75509 | joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) CWE-290 | 6.5 | Medium | 2026-08-24 |
| CVE-2026-62995 | joserfc accepts JWT with padding, leading to JWT malleability CWE-345 | 2.3 | Low | 2026-07-29 |
| CVE-2026-49852 | joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CWE-287 | - | - | 2026-07-17 |
| CVE-2026-48990 | joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization CWE-400 | 5.3 | Medium | 2026-06-17 |
| CVE-2026-27932 | joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) CWE-770 | 7.5 | High | 2026-03-03 |
| CVE-2025-65015 | joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads CWE-770 | 7.5AI | High AI | 2025-11-18 |
All 6 known CVE vulnerabilities affecting joserfc with full Chinese analysis, references, and POCs where available.