Vulnerability Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/authlib/joserfc/commit/76ee6a59bf5773c0af00b99076c5e199031f97
- https://github.com/authlib/joserfc/security/advisories/GHSA-r74j-q665-7rpj
- https://github.com/authlib/joserfc/security/advisories/GHSA-r74j-q665-7rpj
FAQ
What is CVE-2026-75509?
CVE-2026-75509 is a vulnerability with a CVSS score of 6.5 (MEDIUM). joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to lis...
How severe is CVE-2026-75509?
CVE-2026-75509 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75509?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.