Executive brief
joserfc is a Python library used to handle secure digital tokens (JWTs) for authentication and data exchange. A security flaw allows attackers to bypass authentication by creating forged tokens that the library incorrectly accepts as valid if the server's secret key is missing or empty (e.g., due to a configuration error or an unset environment variable). This could allow an unauthorized person to gain administrative access or impersonate other users on systems using this library.
Technical details
A vulnerability in joserfc's HMAC implementation (HS256/HS384/HS512) allows for signature bypass when the verification key is an empty string or None. The root cause is in `OctKey.import_key` and `HMACAlgorithm.verify`, where the library only issues a `SecurityWarning` for short keys but fails to reject zero-length keys. If an application sources its JWT secret from an unset environment variable or a missing configuration entry that defaults to an empty string, an attacker can generate a valid signature using an empty HMAC key. This allows for full authentication bypass and token forgery. The issue is fixed in version 1.6.8 by enforcing a hard rejection of empty keys.
Affected products
- authlib joserfc < 1.6.8
Timeline
- 2026-05-27: patched: Version 1.6.8 released
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD