CyberRota Analysis
AI-GeneratedThe joserfc Python library, prior to version 1.7.3, is vulnerable due to an issuer-validation bypass in the JWTClaimsRegistry, which allows an attacker to manipulate list-valued "iss" claims to bypass intended equality checks. This flaw could lead to unauthorized access or impersonation in applications relying on JWT for authentication. Developers and security teams using this library should prioritize upgrading to version 1.7.3 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.