joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens (CVE-2026-49852)

Overview

A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the joserfc.jwt.decode function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null verification key, allowing an attacker to bypass integrity checks. Successful exploitation could lead to an integrity compromise of data processed by the library.

Vendor advisories

• RHSA-2026:42045 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-20 · advisory

joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-15.

Fixed:

• Red Hat Hardened Images

Not affected:

• Lightspeed Core
• Migration Toolkit for Applications 8
• OpenShift Lightspeed
• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux command line assistant
• Red Hat OpenShift Virtualization 4
• Red Hat Satellite 6

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:42045

Workarounds / mitigations:

• This flaw is only exploitable when an application invokes joserfc.jwt.decode with an empty-string or None verification key. Ensuring a valid, non-empty key is always supplied to JWT verification prevents exploitation. Upgrading joserfc to 1.6.8 or later fully remediates the flaw regardless of how the verification key is supplied.

Package advisory (CVE-2026-49852)

Affected packages:

• joserfc < 1.6.8

Patched in:

• joserfc 1.6.8

Source: https://osv.dev/vulnerability/GHSA-gg9x-qcx2-xmrh