CVE-2026-53939

OpenIDC/cjose is a C library implementing JOSE. In versions 0.6.1 through 0.6.2.5 , when encrypting a JWE using an AES-CBC-HMAC content-encryption algorithm (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) with any key-management algorithm that generates a fresh CEK, the CEK is all zero bytes ins...

CVE-2026-29000-PoC-Exploit

🚀 CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 - One-Click Admin Forge via JWT alg:none + JWE Encryption 📌 Overview This exploit weaponizes CVE-2026-29000 , a critical CVSS 10.0 vulnerability in the pac4j-jwt library. By extracting the server's public JWKS key and...

GHSA-7432-952R-CW78 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Executive Summary A cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption JWE RSA15 key management algorithm. Authlib registers RSA15 in its default algorithm registry without requiring explicit opt-in,...

CVE-2025-54887 jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...