joserfc, a Python library implementing JOSE standards, in versions up to 1.7.1 accepts JWTs containing trailing padding ('=='), which is non-compliant with JOSE specifications. This acceptance leads to malleability of JWTs, meaning tokens can be altered without invalidating their signature under certain signature schemes. Such malleability may undermine security mechanisms like token revocation or anti-replay protections that depend on the assumption that tokens are immutable. The vulnerability does not affect ECDSA JWS tokens uniquely, as ECDSA signatures are inherently malleable. The issue was addressed and fixed in version 1.7.2.

The vulnerability allows JWT malleability in affected versions, which could enable attackers to bypass token revocation or anti-replay protections if these rely on deny lists of tokens or token hashes. The impact is limited and context-dependent, as it depends on how the application uses joserfc and manages token validation. The CVSS score is low (2.3), reflecting limited impact and exploitability.

Upgrade joserfc to version 1.7.2 or later, where this issue has been fixed. There is no indication of official vendor advisory or temporary fixes, but the fix is available in the newer version. No additional mitigation is specified or required beyond applying the update.