If you discover a security vulnerability, do not submit a public issue or patch. Instead, please report it privately through the GitHub Security tab.
Repository navigation
Security: authlib/joserfc
Security
SECURITY.md
-
joserfc OctKey accepts DER-encoded RSA public keys as HMAC secrets (key-type confusion enables HS256 forgery)GHSA-vvgp-wfq3-pjxj published
Nov 3, 2026 by leptureHigh -
List-valued jti is accepted by exact-value JWT claim validationGHSA-mcm9-p458-pjmc published
Nov 3, 2026 by leptureLow -
Compact JWS size guard allocates attacker-controlled segments before rejectionGHSA-9pg5-8c7x-5hfx published
Oct 6, 2026 by leptureModerate -
Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption in `joserfc`GHSA-jpxq-7h8p-2q76 published
Oct 6, 2026 by leptureHigh -
JWE JSON aad segment is decoded with no size limit, bypassing every other JWERegistry capGHSA-hwgg-pgp5-r4ch published
Nov 3, 2026 by leptureHigh -
JWS signature verification bypass via empty signatures array in jws.deserialize_jsonGHSA-4pp3-559j-c5c2 published
Sep 9, 2026 by leptureCritical -
joserfc accepts array-typed single-string claims (iss/sub/jti) , issuer-validation bypassGHSA-r74j-q665-7rpj published
Aug 18, 2026 by leptureModerate -
joserfc accepts JWT with padding, leading to JWT malleabilityGHSA-5jhw-7jv7-qcqq published
Jul 13, 2026 by leptureLow -
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)GHSA-gg9x-qcx2-xmrh published
May 29, 2026 by leptureHigh -
RFC7797 b64=false JWS payloads bypass JWSRegistry payload-size limits during deserializationGHSA-wphv-vfrh-23q5 published
May 24, 2026 by leptureModerate
Learn more about advisories related to authlib/joserfc in the GitHub Advisory Database