CVE-2026-62995Disclosure

LOWCVSS 2.3 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when consumed by joserfc. Depending on this application this might or not be an issue. This could lead to bypass of token revocation or anti-replay protection when implemented as a deny list of tokens or a deny list of token hashes. Note that ECDSA JWS are always malleable because of the malleability of ECDSA signatures (first test case in the code bellow). This makes a scheme which assumes that JWTs are not malleable brittle. However for other signatures (or MAC) schemes it might make sense to assume non malleability of the token. This issue has been fixed in version 1.7.2.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq

Weakness type (CWE)

CWE-345

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-62995 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc acce… https://www.cve.org/CVERecord?id=CVE-2026-62995 ----- Traducción: CVE-2026-62995 jos… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑62995, linking to its CVE record and noting it impacts versions of the joserfc Python library prior to 1.7.1.
0000026
96 followersView on X
CVE@CVEnew92d
General
CVE-2026-62995 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc acce… https://www.cve.org/CVERecord?id=CVE-2026-62995
Post summary
The excerpt references CVE-2026-62995 with minimal detail, noting the affected Python library and version range but providing no information on exploitation, fixes, or technical specifics.
00000578
57.9K followersView on X

Explore more

Back to dashboard