{"id":"CVE-2026-49852","title":"joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens (CVE-2026-49852)","summary":"A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the `joserfc.jwt.decode` function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null ver…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":["CWE-347","CWE-287","CWE-326","CWE-1391"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["hardened_images"],"patched":["hardened_images"],"published":"2026-07-17","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:03:51+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49852.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49852.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-49852"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501881"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49852"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49852"},{"url":"https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1"},{"url":"https://github.com/authlib/joserfc/releases/tag/1.6.8"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh"},{"url":"https://access.redhat.com/errata/RHSA-2026:42045"},{"url":"https://github.com/authlib/joserfc"},{"url":"https://github.com/authlib/joserfc/blob/1ddca8f3c73ff47e3bc3ac06cb0c08a9535677ec/src/joserfc/_rfc7518/jws_algs.py#L62-L70"},{"url":"https://github.com/advisories/GHSA-gg9x-qcx2-xmrh"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00171,"epssPercentile":0.06459,"aliases":["GHSA-gg9x-qcx2-xmrh","PYSEC-2026-2528"],"ecosystem":"pip","ingestedAt":"2026-07-02T19:41:50.947Z","slug":"CVE-2026-49852","body":"## Overview\n\nA flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the `joserfc.jwt.decode` function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null verification key, allowing an attacker to bypass integrity checks. Successful exploitation could lead to an integrity compromise of data processed by the library.\n\n## Vendor advisories\n\n- **RHSA-2026:42045** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42045)\n\n**joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens** — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-15.\n\nFixed:\n\n- Red Hat Hardened Images\n\nNot affected:\n\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux command line assistant\n- Red Hat OpenShift Virtualization 4\n- Red Hat Satellite 6\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:42045\n\nWorkarounds / mitigations:\n\n- This flaw is only exploitable when an application invokes joserfc.jwt.decode with an empty-string or None verification key. Ensuring a valid, non-empty key is always supplied to JWT verification prevents exploitation. Upgrading joserfc to 1.6.8 or later fully remediates the flaw regardless of how the verification key is supplied.\n\n## Package advisory (CVE-2026-49852)\n\nAffected packages:\n\n- `joserfc < 1.6.8`\n\nPatched in:\n\n- `joserfc 1.6.8`\n\nSource: https://osv.dev/vulnerability/GHSA-gg9x-qcx2-xmrh","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222229,"id":"CVE-2026-49852","ts":1792065106289,"field":"cvss","old":null,"new":"7.5"}]}