Vulnerability · Published Aug 24, 2026 · Assigned by GitHub_M
CVE-2026-75509joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
Medium 6.5
In plain English
A medium-severity authentication bypass by spoofing in joserfc from authlib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | joserfc | no fix listed | DEBIAN-CVE-2026-75509 |
| Debian:14 | joserfc | 1.7.3-1 | DEBIAN-CVE-2026-75509 |
| Ubuntu:26.04:LTS | joserfc | no fix listed | UBUNTU-CVE-2026-75509 |
Affected products (as reported)
Weakness: CWE-290, CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N