CVE-2026-102946

CRITICAL 9.1CVE-2026-102946 · Published 15/10/2026 · updated 15/10/2026

In short

CVE-2026-102946 is a CRITICAL (CVSS 9.1) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.12%, higher than 1.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free