https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T04:48:36.730992+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-75509 CVE-2026-75509 — joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) 2026-10-04T04:48:36.747012+00:00

Affected: authlib joserfc

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.