Quick answers
- Is CVE-2026-62995 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62995 being exploited in the wild.
- How severe is CVE-2026-62995?
- Informational severity, with a CVSS score of 2.3, published 29 July 2026.
- Which products and versions are affected?
- Authlib Joserfc <= 1.7.1.
- Is there a fix for CVE-2026-62995?
- A patch was published on 2026-07-29: Fix released in version 1.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62995 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-62995?
- Check whether you run Authlib Joserfc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The joserfc library (versions 1.7.1 and prior) incorrectly accepts JSON Web Tokens (JWTs) containing trailing base64 padding (==), which violates JOSE specifications. This results in token malleability, where multiple valid-looking encoded strings can represent the same underlying claims and signature. An attacker can exploit this to bypass security mechanisms that rely on token uniqueness, such as revocation deny-lists or anti-replay protections based on token hashes. While ECDSA signatures are inherently malleable, this flaw extends malleability to other signature and MAC schemes that would otherwise be rigid. The issue is resolved in version 1.7.2.
Affected products
- authlib joserfc <= 1.7.1
Timeline
- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: NVD publication date
- 2026-07-29: patched: Fix released in version 1.7.2