Skip to content
Threat Feed
Subscribe

Vendor

Authlib

1 brief RSS
high advisory

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (CVE-2026-49852)

A critical vulnerability, CVE-2026-49852, exists in the Python `joserfc` library (versions `<= 1.6.7`) where HMAC-signed JSON Web Tokens can be forged, leading to complete authentication bypass, if the application is configured to verify tokens with an empty or `None` HMAC key.

joserfc <= 1.6.7 authentication-bypass jwt python vulnerability cve
1t