CVE-2026-49852
NoneCVSS
—
EPSS
0.2%
Published
Jul 17, 2026
CISA due date
—
The record
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign and HMACAlgorithm.verify in src/joserfc/_rfc7518/jws_algs.py pass the output of OctKey.get_op_key(...) to hmac.new(...) and OctKey.import_key in src/joserfc/_rfc7518/oct_key.py only emits a SecurityWarning for keys shorter than 14 bytes without rejecting zero-length input. This issue is fixed in version 1.6.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-joserfc | 0 | 1.7.2-2.1 |
Related vulnerabilities
- CVE-2026-48990 joserfc is a Python library that provides an implementation of several JSON Object… Also affects python-joserfc
- CVE-2026-27932 joserfc is a Python library that provides an implementation of several JSON Object… Also affects python-joserfc
- CVE-2026-121531 A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. CWE-287
- CVE-2026-120574 The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in… CWE-287
- CVE-2026-120538 The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass… CWE-287
- CVE-2026-58915 A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD)… CWE-287
- CVE-2026-120447 HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows… CWE-287
- CVE-2026-120278 A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. CWE-287