{"id":"UBUNTU-CVE-2026-102946","details":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.","modified":"2026-10-17T12:57:56.318660070Z","published":"2026-10-16T00:00:00Z","upstream":["CVE-2026-102946"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102946"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-102946"},{"type":"REPORT","url":"https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe"},{"type":"REPORT","url":"https://github.com/authlib/joserfc/releases/tag/1.7.4"},{"type":"REPORT","url":"https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2"}],"affected":[{"package":{"name":"joserfc","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/joserfc?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2-1","1.6.5-1","1.6.8-1","1.7.0-1","1.7.1-1","1.7.2-1","1.7.4-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-joserfc","binary_version":"1.7.4-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102946.json"}},{"package":{"name":"joserfc","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/joserfc?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1","1.4.0-1","1.4.1-1","1.4.3-1","1.5.0-1","1.6.2-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.6.2-1","binary_name":"python3-joserfc"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102946.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]}