CVE-2026-62995: CWE-345: Insufficient Verification of Data Authenticity in authlib joserfc
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when consumed by joserfc. Depending on this application this might or not be an issue. This could lead to bypass of token revocation or anti-replay protection when implemented as a deny list of tokens or a deny list of token hashes. Note that ECDSA JWS are always malleable because of the malleability of ECDSA signatures (first test case in the code bellow). This makes a scheme which assumes that JWTs are not malleable brittle. However for other signatures (or MAC) schemes it might make sense to assume non malleability of the token. This issue has been fixed in version 1.7.2.
AI Analysis
Technical Summary
joserfc, a Python library implementing JOSE standards, in versions up to 1.7.1 accepts JSON Web Tokens (JWTs) containing trailing padding (==), which is non-compliant with JOSE specifications. This acceptance leads to malleability of JWTs, meaning tokens can be altered without invalidating their signature under certain signature schemes. Such malleability can undermine security mechanisms like token revocation or anti-replay protections that depend on exact token or token hash matching. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity). The issue is resolved in joserfc version 1.7.2.
Potential Impact
The vulnerability allows JWT malleability due to acceptance of trailing padding, which can lead to bypassing token revocation or anti-replay protections if these rely on exact token or token hash matching. The impact is limited and context-dependent, as some signature schemes (e.g., ECDSA) are inherently malleable and some applications may not rely on non-malleability assumptions. No known exploits are reported in the wild. The CVSS 4.0 score is 2.3, indicating low severity.
Mitigation Recommendations
Upgrade joserfc to version 1.7.2 or later, where this issue has been fixed. No other mitigation is indicated. Patch status is not explicitly stated as 'official-fix' or 'temporary-fix' in the vendor advisory, but the description confirms the issue is fixed in 1.7.2.
CVE-2026-62995: CWE-345: Insufficient Verification of Data Authenticity in authlib joserfc
Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when consumed by joserfc. Depending on this application this might or not be an issue. This could lead to bypass of token revocation or anti-replay protection when implemented as a deny list of tokens or a deny list of token hashes. Note that ECDSA JWS are always malleable because of the malleability of ECDSA signatures (first test case in the code bellow). This makes a scheme which assumes that JWTs are not malleable brittle. However for other signatures (or MAC) schemes it might make sense to assume non malleability of the token. This issue has been fixed in version 1.7.2.
CVSS v4.0
Score 2.3low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
joserfc, a Python library implementing JOSE standards, in versions up to 1.7.1 accepts JSON Web Tokens (JWTs) containing trailing padding (==), which is non-compliant with JOSE specifications. This acceptance leads to malleability of JWTs, meaning tokens can be altered without invalidating their signature under certain signature schemes. Such malleability can undermine security mechanisms like token revocation or anti-replay protections that depend on exact token or token hash matching. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity). The issue is resolved in joserfc version 1.7.2.
Potential Impact
The vulnerability allows JWT malleability due to acceptance of trailing padding, which can lead to bypassing token revocation or anti-replay protections if these rely on exact token or token hash matching. The impact is limited and context-dependent, as some signature schemes (e.g., ECDSA) are inherently malleable and some applications may not rely on non-malleability assumptions. No known exploits are reported in the wild. The CVSS 4.0 score is 2.3, indicating low severity.
Mitigation Recommendations
Upgrade joserfc to version 1.7.2 or later, where this issue has been fixed. No other mitigation is indicated. Patch status is not explicitly stated as 'official-fix' or 'temporary-fix' in the vendor advisory, but the description confirms the issue is fixed in 1.7.2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-14T23:10:57.032Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6a48789c2644c7f8e5158f
Added to database: 07/29/2026, 18:37:44 UTC
Last enriched: 07/29/2026, 18:53:06 UTC
Last updated: 07/30/2026, 00:51:20 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.