joserfc: Signature verification bypass via empty signatures array in JWS General JSON
Summary
joserfc is a Python library implementing JOSE standards. Before version 1.7.4, the General JSON Serialization path of JWS deserialization treats a message with an empty signatures array as authenticated. An attacker without a signing key can therefore supply an arbitrary payload that the relying application may accept as genuine. The flaw does not affect compact JWS/JWT, Flattened JSON serialization or JWE JSON processing.
Affected
- joserfc versions prior to 1.7.4 (vendor advisory GHSA-4pp3-559j-c5c2)
- Only applications that use jws.deserialize_json() with General JSON Serialization are affected
- Note: third-party databases list different ranges (for example 1.7.3-1.7.4); the vendor range is treated as authoritative
Fixed in
- Fixed in joserfc 1.7.4 (fix commit f409f8f)
- Newer releases exist; check the latest stable release notes before upgrading
Workaround
- No vendor-documented workaround.
- If an upgrade is delayed, review application code that calls General JSON deserialization and do not trust its result without independent checks.
Exploitation
- CISA SSVC data (ADP) lists exploitation as 'poc' and automatable as 'yes'.
- No confirmed in-the-wild exploitation found.
- Not listed in CISA KEV.
Our recommendation
- Check for joserfc in application dependencies, SBOMs and pip lock files, including indirect dependencies.
- Upgrade to joserfc 1.7.4 or later.
- Prioritise internet-facing Python services that verify JOSE objects.
- Test the authentication path after the upgrade and review code that uses General JSON serialization.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4pp3-559j-c5c2 github.com
- Fix commit f409f8f github.com
- joserfc release 1.7.4 github.com
- Ubuntu security notice CVE-2026-102946 ubuntu.com
- OSV Debian CVE-2026-102946 osv.dev
- OpenCVE CVE-2026-102946 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:32.
Original description (NVD)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.