CVE-2026-48990: authlib joserfc resource exhaustion via oversized RFC7797 payloads

Executive brief

The joserfc library, used for handling secure web tokens (JWS), fails to enforce size limits on certain types of unencoded data. An attacker could send an excessively large token to a server, potentially causing the application to crash or consume all available memory. This can lead to a service outage or significant performance degradation.

Technical details

A vulnerability in joserfc's deserialization logic allows RFC7797 JWS payloads with the 'b64=false' header to bypass configured size limits. While standard JWS paths correctly invoke validate_payload_size() before decoding, the unencoded payload paths in both compact and flattened JSON deserialization assign the payload segment directly without validation. An unauthenticated remote attacker can exploit this by providing oversized payloads to trigger resource exhaustion or DoS. The issue is fixed in version 1.6.7 by ensuring registry.validate_payload_size() is called for unencoded payload segments.

Affected products

• authlib joserfc >= 1.3.4, < 1.6.7

Timeline

• 2026-05-24: disclosed
• 2026-06-26: advisory: GitHub Advisory published
• 1.6.7: patched

References

• https://api.github.com/users/0xHunSec
• https://github.com/0xHunSec
• https://api.github.com/users/0xHunSec/gists%7B/gist_id%7D
• https://api.github.com/users/0xHunSec/repos
• https://avatars.githubusercontent.com/u/39668014?v=4
• https://api.github.com/users/0xHunSec/events%7B/privacy%7D