CVE-2026-102946

Summary

The joserfc library incorrectly accepts JWS General JSON Serialization with empty signatures arrays as authenticated, allowing attackers to forge valid-looking JWTs without possessing the signing key. This creates a critical authentication bypass vulnerability where applications trust arbitrary payloads as authentic.

Exploitability

Very easy to exploit with no preconditions - attackers simply need to craft a JWS General JSON payload with an empty signatures array and provide it to vulnerable applications, which will treat it as authenticated without any signature verification.

Blast radius

Widespread impact across any application using joserfc 1.7.3 or earlier for JWT validation, potentially affecting authentication systems, API gateways, and microservices that rely on JWT-based authentication.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.7.4 immediately

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.