---
id: CVE-2026-49852
title: >-
  joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens
  (CVE-2026-49852)
summary: >-
  A flaw was found in the joserfc Python library. A remote attacker can exploit
  a vulnerability in the `joserfc.jwt.decode` function to forge HMAC-signed
  tokens. This occurs because the library accepts tokens signed with an empty or
  null ver…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: vendor
cwe:
  - CWE-347
  - CWE-287
  - CWE-326
  - CWE-1391
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - hardened_images
patched:
  - hardened_images
published: '2026-07-17'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:03:51+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49852.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49852.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-49852'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2501881'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-49852'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49852'
  - url: >-
      https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1
  - url: 'https://github.com/authlib/joserfc/releases/tag/1.6.8'
  - url: 'https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh'
  - url: 'https://access.redhat.com/errata/RHSA-2026:42045'
  - url: 'https://github.com/authlib/joserfc'
  - url: >-
      https://github.com/authlib/joserfc/blob/1ddca8f3c73ff47e3bc3ac06cb0c08a9535677ec/src/joserfc/_rfc7518/jws_algs.py#L62-L70
  - url: 'https://github.com/advisories/GHSA-gg9x-qcx2-xmrh'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
epss: 0.00171
epssPercentile: 0.06459
aliases:
  - GHSA-gg9x-qcx2-xmrh
  - PYSEC-2026-2528
ecosystem: pip
ingestedAt: '2026-07-02T19:41:50.947Z'
---

## Overview

A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the `joserfc.jwt.decode` function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null verification key, allowing an attacker to bypass integrity checks. Successful exploitation could lead to an integrity compromise of data processed by the library.

## Vendor advisories

- **RHSA-2026:42045** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42045)

**joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens** — rated Important by Red Hat. Released 2026-07-17, updated 2026-10-15.

Fixed:

- Red Hat Hardened Images

Not affected:

- Lightspeed Core
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux command line assistant
- Red Hat OpenShift Virtualization 4
- Red Hat Satellite 6

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:42045

Workarounds / mitigations:

- This flaw is only exploitable when an application invokes joserfc.jwt.decode with an empty-string or None verification key. Ensuring a valid, non-empty key is always supplied to JWT verification prevents exploitation. Upgrading joserfc to 1.6.8 or later fully remediates the flaw regardless of how the verification key is supplied.

## Package advisory (CVE-2026-49852)

Affected packages:

- `joserfc < 1.6.8`

Patched in:

- `joserfc 1.6.8`

Source: https://osv.dev/vulnerability/GHSA-gg9x-qcx2-xmrh