CVE-2026-89086 in Jose
Summary
by MITRE • 09/10/2026
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability in the jose package prior to version 0.11.0 represents a critical failure in cryptographic validation logic within OCaml-based applications relying on this library for JSON Web Signature operations. The core issue stems from an incomplete implementation of RSA signature verification, where the process terminates prematurely after successfully decoding the PKCS #1 formatted data but before performing any actual mathematical verification against the provided public key. This flaw effectively bypasses the fundamental security mechanism designed to ensure that a digital signature was indeed created by the holder of the corresponding private key and has not been tampered with since its creation.
In standard RSA signature validation, the process involves several rigorous steps: first, the PKCS #1 encoded signature is decoded into an integer value; second, this value is mathematically processed using the public exponent from the recipient's public key to recover a hash of the original message; and third, this recovered hash is compared against a freshly computed hash of the received message. If these two hashes match, the signature is valid. The jose library failed at the final stage by accepting any successfully decoded PKCS #1 structure as a valid signature regardless of whether it corresponded to the public key or contained meaningful data related to the signed content. This omission means that an attacker does not need access to the private key nor knowledge of the specific cryptographic parameters associated with the legitimate signer's identity.
The operational impact of this vulnerability is severe, particularly in systems where JSON Web Tokens are used for authentication and authorization decisions. An adversary can craft a maliciously formatted signature block that satisfies the PKCS #1 decoding requirement but bears no relation to any valid RSA public key or signed payload. When such a forged token is presented to an application using the vulnerable jose library version, the system will erroneously accept it as authentic. This allows for complete authentication bypass, enabling unauthorized access to protected resources, privilege escalation, and potential data exfiltration without triggering standard security alerts associated with invalid signatures.
This flaw aligns directly with CWE-347, which describes Improper Verification of Cryptographic Signature, a category of vulnerabilities where the integrity or authenticity of data is not properly confirmed before processing. Furthermore, from an offensive perspective, this vulnerability facilitates techniques categorized under MITRE ATT&CK T1550, specifically sub-techniques related to use of alternate authentication credentials or impersonation through forged tokens. Attackers can exploit this weakness to inject arbitrary claims into JWTs, effectively masquerading as legitimate users or administrative entities within the affected application ecosystem.
Mitigation requires an immediate upgrade of the jose package to version 0.11.0 or later, where the developers have corrected the verification logic to ensure that all necessary cryptographic checks are performed against the public key before declaring a signature valid. In environments where upgrading is not immediately feasible, temporary mitigations should focus on implementing additional validation layers at the application level. This includes manually verifying RSA signatures using independent, well-audited cryptographic libraries or enforcing strict schema validations that reject tokens with malformed structures even if they technically pass basic decoding checks. Regular security audits and static code analysis tools configured to detect improper signature verification patterns can also help identify similar implementation flaws in other parts of the codebase before exploitation occurs.