Is CVE-2026-65625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65625 being exploited in the wild.

How severe is CVE-2026-65625?

Informational severity, published 26 October 2026.

Is there a fix for CVE-2026-65625?

Yes: fixed in jose 1.11.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65625 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65625?

Check whether you run JOSE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65625: jose AES-GCM authentication tag truncation in fallback

CVE-2026-65625 · Severity: info · Published 2026-10-26

jose is a JWT/JWE library that provides encrypted JSON Web Encryption tokens. The pure-Erlang AES-GCM fallback used when native crypto is unavailable accepts truncated authentication tags, allowing an attacker to forge valid tokens by reducing verification strength from 2^-128 to 2^-8. This can lead to account takeover or data access if JWE tokens are used for authentication or sensitive operations.

Technologies: JOSE. Vendors: Jose.

Quick answers

Is CVE-2026-65625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65625 being exploited in the wild.
How severe is CVE-2026-65625?: Informational severity, published 26 October 2026.
Which products and versions are affected?: JOSE 1.2.0 to before 1.11.13.
Is there a fix for CVE-2026-65625?: Yes: fixed in jose 1.11.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65625 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65625?: Check whether you run JOSE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: jose 1.11.13

Technical details

The vulnerability exists in the pure-Erlang AES-GCM fallback implementation (jose_jwa_aes), where the block_decrypt/4 function derives the number of bits to verify from the attacker-supplied authentication tag length rather than enforcing the standard 128-bit requirement. An attacker can truncate a JWE token's authentication tag to as few as 8 bits, reducing forgery resistance to 2^-8, allowing reliable token forgery within ~256 attempts without key knowledge.

Affected products

jose jose 1.2.0 to before 1.11.13

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.