CVE-2026-75509

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption JOSE standards. A remote attacker could exploit a vulnerability in the JWTClaimsRegistry by crafting a JSON Web Token JWT with an array-valued issuer iss claim. This flaw allows the attacker to bypass the intende...

CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...