Critical Authlib Joserfc Flaw Allows Unauthenticated Payloads in Versions Before 1.7.4

The National Vulnerability Database has published details on a critical vulnerability, CVE-2026-102946, affecting the joserfc Python library. This flaw allows attackers to bypass signature verification mechanisms by submitting JSON Web Signatures with empty signature arrays. The issue enables unauthorized users to inject arbitrary data that relying applications may accept as legitimate and authenticated.

The vulnerability stems from how the joserfc.jws.deserialize_json() function processes JWS General JSON Serialization. According to the NVD record, the verify_general_json() loop performs no iterations when presented with an empty signatures array. Because no signature checks are executed, the function returns success by default, assuming no failures occurred. This logic error allows an attacker without a signing key to forge authenticated payloads.

Technical Context and Scope

The National Vulnerability Database assigns this flaw a CVSS score of 9.1, rating it as critical. The weakness is associated with CWE-290, CWE-345, and CWE-347, indicating failures in authentication and integrity verification. The issue specifically impacts the General JSON Serialization path within the library. Other serialization methods, including compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing, do not follow this vulnerable code path and remain unaffected by this specific bypass technique.

Affected Software and Versions

The vulnerability affects the authlib joserfc library in all versions prior to 1.7.4. Developers using this Python package for implementing JSON Object Signing and Encryption standards are at risk if they rely on the general JSON serialization method. The NVD record confirms that the issue is fixed in version 1.7.4. Organizations must identify instances of this library in their software supply chains to determine if they are running vulnerable code that could be exploited by remote attackers.

What should you do?

Security teams should immediately audit their Python dependencies to check for versions of joserfc earlier than 1.7.4. If vulnerable versions are found, upgrade to version 1.7.4 or later as soon as possible. Monitor application logs for unusual authentication patterns or unexpected payload structures that might indicate exploitation attempts. Review security controls around JSON Web Signature validation to ensure other libraries are not similarly configured to accept empty signature arrays as valid.