PT-2026-81024

CVE-2026-75509

Published

2026-08-24

Updated

2026-09-24

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.3

Description The JWTClaimsRegistry component incorrectly applies membership matching to list-valued iss and sub claims. This behavior allows an array-valued iss that contains the expected issuer to pass an equality check, which enables a bypass of the issuer validation process.

Recommendations Update to version 1.7.3.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

CWE-290: Authentication Bypass by Spoofing

Related identifiers

CVE-2026-75509