joserfc 1.7.4 Fixes Critical Signature Bypass in Python Library

The Python library joserfc contains a critical authentication bypass flaw that allows attackers to supply arbitrary payloads treated as authentic. This issue impacts applications relying on the library for JSON Object Signing and Encryption standards before version 1.7.4. Security teams using this component must verify their dependency versions immediately, as the flaw enables unauthenticated data injection into trusted processing pipelines.

Root cause

The vulnerability stems from how joserfc.jws.deserialize_json() handles JWS General JSON Serialization inputs. According to the NVD record, the function accepts an empty signatures array as valid. The verify_general_json() loop performs no iterations when the array is empty, returning success because no signature check failed. This logic error allows an attacker without a signing key to bypass authentication entirely.

Attack path

An adversary constructs a JWS General JSON Serialization with an empty signatures array. When the vulnerable library processes this input, it skips signature verification steps. The application then treats the payload as authenticated and authentic. This path is specific to the General JSON Serialization method; compact JWS, JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable code path.

Affected versions

• joserfc versions before 1.7.4 are affected.
• The fix is available in version 1.7.4.
• The issue is tracked as CVE-2026-102946.

Mitigation

• Upgrade joserfc to version 1.7.4 or later immediately.
• Audit applications using joserfc for General JSON Serialization usage.
• Implement additional server-side validation for critical payloads.
• Monitor logs for unexpected authentication successes without signatures.

Signals worth monitoring

Teams usually detect this activity by reviewing application logs for successful authentication events lacking corresponding cryptographic signatures. Check whether identity providers or API gateways report anomalous payload structures in recent access logs. Defenders should examine authentication service metrics for spikes in processed requests that bypass standard signature verification steps. Look for unusual user behaviour patterns following unauthenticated access attempts. Containment moves typically involve isolating affected services and rotating compromised credentials while verifying that legacy serialization methods are disabled or patched.

What to do and how to stay safe: joserfc

• Identify all Python services importing joserfc and check their version numbers.
• Review recent authentication logs for payloads with empty signature arrays.
• Apply the vendor update once the maintainer provides version 1.7.4.
• Enhance monitoring rules to flag missing cryptographic validation steps.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE ID tracks this joserfc vulnerability?

The issue is tracked as CVE-2026-102946 according to the NVD record.

Does this flaw affect compact JWS decoding?

No, the vulnerability only affects the General JSON Serialization path.

What is the CVSS score for this issue?

The NVD rates the severity as CVSS 9.1 Critical.