CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

GHSA-HXM8-2XGR-2P9M PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2025-4658 Authentication Bypass in OPKSSH

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and...

CVE-2025-3757

OpenPubkey library, versions prior to 0.10.0, contain a vulnerability that allows a specially crafted JWS to bypass signature verification. This is documented across multiple connected sources (e.g., OSV/GHSA entries) and is the root cause described by CVE-2025-3757. Impact is high for confidenti...

CVE-2025-3757 Authentication Bypass in OpenPubKey

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification...

CVE-2025-3757

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification...

CVE-2025-3757 Authentication Bypass in OpenPubKey

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification...

CVE-2025-3757 Authentication Bypass in OpenPubKey

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification...

CVE-2022-25898

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has...