Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 22:59:23 +0000 CVE-2026-75509 — joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) https://vulnerability.circl.lu/vuln/cve-2026-75509 <p><strong>Affected:</strong> authlib joserfc</p> <p>joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.</p> <p><strong>Affected:</strong> authlib joserfc</p> <p>joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-75509