CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

Low 2.3 Published 29 Jul 2026 Updated 30 Jul 2026

Attackers can bypass token revocation or anti-replay protections by exploiting JWT malleability caused by non-standard padding acceptance in the joserfc library.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-62995?

CVE-2026-62995 is a low-severity vulnerability in authlib joserfc, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when consumed by joserfc. Depending on this application this might or not be an issue. This could lead to bypass of token revocation or anti-replay protection when implemented as a deny list of tokens or a deny list of token hashes. Note that ECDSA JWS are always malleable because of the malleability of ECDSA signatures (first test case in the code bellow). This makes a scheme which assumes that JWTs are not malleable brittle. However for other signatures (or MAC) schemes it might make sense to assume non malleability of the token. This issue has been fixed in version 1.7.2.

Weakness: CWE-345

Which versions are affected by CVE-2026-62995?

Linux distribution packages (2)

`python-joserfc` openSUSE:Leap 16.0	All versions	`1.1.0-bp160.4.1`
`python-joserfc` openSUSE:Tumbleweed	All versions	`1.7.4-2.1`

How do I fix CVE-2026-62995?

Upgrade to a fixed version.

Is CVE-2026-62995 being exploited?

There is no known exploitation of CVE-2026-62995 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-TT52719, DEBIAN-CVE-2026-62995, GHSA-5jhw-7jv7-qcqq, UBUNTU-CVE-2026-62995, openSUSE-SU-2026:11423-1, openSUSE-SU-2026:21515-1.