Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a signature verification bypass vulnerability in joserfc (CVE-2026-49852)

Summary An authentication and signature verification bypass vulnerability in the joserfc JSON Object Signing and Encryption JOSE library CVE-2026-49852 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.6.8. Vulnerability Details...

CVE-2026-49852: Improper Authentication

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...