CVE-2026-49852

Name of the Vulnerable Software and Affected Versions joserfc versions 1.6.7 and earlier

Description An authentication bypass exists when the verification key provided to joserfc.jwt.decode is an empty string or None. This occurs because the HMACAlgorithm.verify() and HMACAlgorithm.sign() functions pass the key directly to hmac.new() without validating its length. While OctKey.import key() issues a SecurityWarning for keys shorter than 14 bytes, it does not reject zero-length keys. Consequently, if an application's JWT secret is unset (e.g., missing environment variable or empty database row), an unauthenticated attacker can forge valid HMAC-signed tokens by signing them with an empty key, allowing them to manipulate claims such as sub or admin.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.