authlib joserfc up to 1.7.1 authentication replay

Summaryinfo

A vulnerability labeled as critical has been found in authlib joserfc up to 1.7.1. Affected is an unknown function. The manipulation results in authentication replay. This vulnerability is known as CVE-2026-62995. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, was found in authlib joserfc up to 1.7.1. Affected is an unknown part. The manipulation with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when consumed by joserfc. Depending on this application this might or not be an issue. This could lead to bypass of token revocation or anti-replay protection when implemented as a deny list of tokens or a deny list of token hashes. Note that ECDSA JWS are always malleable because of the malleability of ECDSA signatures (first test case in the code bellow). This makes a scheme which assumes that JWTs are not malleable brittle. However for other signatures (or MAC) schemes it might make sense to assume non malleability of the token. This issue has been fixed in version 1.7.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-62995 since 07/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1040.

Upgrading to version 1.7.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• authlib

Name

• joserfc

Version

• 1.7.0
• 1.7.1

Website

• Product: https://github.com/authlib/joserfc/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion