Key points
- CVE-2026-102946 is rated Critical with a CVSS score of 9.1.
- The flaw affects joserfc versions prior to 1.7.4.
- Version 1.7.4 includes a patch that resolves the issue.
The Python library joserfc contains a critical security flaw that affects all versions released before 1.7.4. This vulnerability, tracked as CVE-2026-102946, carries a CVSS score of 9.1. The issue allows attackers to bypass authentication checks by supplying forged data. A fix is available in version 1.7.4. Small-business owners using Python applications that rely on this library should verify their current version immediately to determine if they are exposed to this risk.
In plain English
The joserfc library helps software handle JSON Object Signing and Encryption standards. In versions older than 1.7.4, the function responsible for deserializing JSON Web Signatures has a logic error. It accepts a signature array that is completely empty as if it were valid. Because the verification loop finds no signatures to check, it assumes success. This means an attacker can send a payload without any signing key, and the application may treat it as authentic.
The background
According to the National Vulnerability Database, the flaw stems from weaknesses classified as CWE-290, CWE-345, and CWE-347. The vulnerability exists specifically in the General JSON Serialization path. Other methods, such as compact JWS decoding, JWT decoding, Flattened JSON serialization, and JWE JSON processing, do not follow this vulnerable code path. Therefore, only applications using the specific General JSON Serialization feature are affected by this bypass.
What changes now
The vendor has released version 1.7.4, which fixes the issue. Applications relying on the vulnerable code path must upgrade to this version or later to restore proper signature verification. Until the update is applied, the library will continue to accept empty signature arrays as valid. This leaves any relying applications open to unauthenticated payload injection. There is no confirmed workaround other than upgrading the library or avoiding the vulnerable serialization method.
Who needs to act first
Teams should prioritize updating systems that expose the General JSON Serialization feature to external users. Check whether your applications accept untrusted JSON Web Signatures from the internet. Before rolling out the update, test it in a staging environment to ensure compatibility. Back up your current configuration and codebase. If an immediate update is not possible, restrict access to endpoints that process these signatures. Monitor logs for unusual authentication patterns while you prepare the patch.
What to do and how to stay safe: joserfc
- Inventory all Python applications using joserfc and identify their current versions.
- Upgrade to version 1.7.4 or later as soon as testing confirms stability.
- Review application logs for signs of unauthenticated access attempts.
- Restrict network access to services handling JSON Web Signatures if immediate patching is not feasible.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of joserfc are affected by this vulnerability?
All versions of joserfc prior to 1.7.4 are affected by this critical flaw.
Is there a fix available for CVE-2026-102946?
Yes, the issue is fixed in version 1.7.4 of the library.
Does this affect all JSON processing in joserfc?
No, only the General JSON Serialization path is vulnerable; other methods like compact JWS and JWT decoding are not affected.
