CVE-2026-65625

The jose library (versions 1.2.0 to before 1.11.13) contains a vulnerability in its pure-Erlang AES-GCM fallback. The jose_jwa_aes component fails to validate the length of the attacker-supplied authentication tag, leading to a tag forgery and integrity bypass . By truncating the tag to as little...