Executive brief
The jose library for OCaml, which handles cryptographic signing and validation of JSON Web Tokens (JWTs), fails to properly verify RSA signatures using the public key. An attacker can forge valid-looking tokens by mixing legitimate signature encoding with unauthorized payload data, allowing account takeover or privilege escalation without possessing the correct signing key.
Technical details
This vulnerability is a cryptographic verification failure (CWE-347: Improper Verification of Cryptographic Signature). The jose library's RSA signature validation routine only checks that PKCS#1 decoding succeeds, but skips the critical step of verifying the signature against the public key and the actual token payload/header. An attacker can craft a forged JWT by combining the header and signature from one valid token with the payload from another (or a malicious payload), and the library will accept it as valid. The vulnerability affects all versions before 0.11.0 and is remotely exploitable over any network channel transmitting JWTs. Patch version 0.11.0 addresses this by adding proper payload and header validation during signature verification.
Affected products
- OCaml jose before 0.11.0
Timeline
- 2026-08-25: disclosed: Private report via email to jose authors
- 2026-08-25: patched: Fix published to repository
- 2026-09-04: advisory: jose 0.11.0 released with fix
- 2026-09-10: advisory: Public advisory published