Update joserfc Libraries to Block Signature Forgery Attacks

The National Vulnerability Database reported CVE-2026-102946, a critical security flaw in the joserfc Python library. This issue allows attackers to forge digital signatures without possessing valid cryptographic keys. Users relying on this library for secure data handling face immediate risks if they have not updated their systems.

The flaw resides in how the library processes specific JSON Web Signature formats. According to the NVD record, the `joserfc.jws.deserialize_json()` function incorrectly accepts inputs with empty signature arrays as authenticated. This occurs because the verification loop performs no checks when the array is empty, returning success by default.

Scope of the vulnerability

The issue specifically affects the General JSON Serialization path within the library. Other processing methods remain unaffected by this specific bypass. Compact JWS and JWT decoding do not follow the vulnerable code path. Flattened JSON serialization and JWE JSON processing are also safe from this particular exploit.

Developers using the library must ensure they are not relying on the General JSON Serialization method for authentication checks. The NVD record confirms that the vulnerability is present in all versions of joserfc prior to 1.7.4. Any application using these older versions is potentially exposed to signature forgery attacks.

Who is affected

Any organization using the joserfc library in Python applications is at risk if they have not upgraded. The library is designed to implement JSON Object Signing and Encryption standards. It is used for handling JOSE standards in Python environments.

The NVD record identifies the affected component as `authlib joserfc`. This indicates that the vulnerability is tracked under the Authlib project name. Users of the joserfc module within the Authlib ecosystem should verify their version status. Small business owners should audit their Python dependencies to identify if this library is in use.

What to watch

The vendor has released version 1.7.4, which fixes this issue. Users should prioritize updating their installations to this version or later. Monitoring security advisories for any follow-up patches or related vulnerabilities is also recommended.

Teams should verify that their applications correctly validate signatures after updating. Ensuring that the new version is actively being used in production environments is critical. Checking build logs and dependency reports can confirm successful deployment of the fix.

What made it possible

This incident highlights the risks of logic errors in cryptographic validation routines. Attackers exploit assumptions about data structure completeness to bypass security checks. When verification loops fail to handle edge cases like empty inputs, they may default to success. Teams usually review code paths that process untrusted inputs to ensure robust validation. Check whether your systems enforce strict schema validation before processing cryptographic signatures.

Background: Security advisories

Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.

Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk

What to do and how to stay safe: joserfc

• Audit your Python projects to identify if joserfc is a dependency.
• Upgrade joserfc to version 1.7.4 or later immediately.
• Verify that your applications use the updated library in production.
• Monitor security feeds for any new vulnerabilities in related libraries.

Step-by-step guide: Risk-Based Vulnerability Management: How to Prioritize What to Fix First

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102946?

The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.1.

Which versions of joserfc are affected by this flaw?

All versions of joserfc prior to 1.7.4 are affected by this signature forgery vulnerability.

Is there a fix available for this issue?

Yes, the issue is fixed in version 1.7.4 of the joserfc library.