CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
Attackers can bypass JWT issuer validation by using array-valued claims, allowing unauthorized access in applications using joserfc.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75509?
CVE-2026-75509 is a medium-severity authentication bypass vulnerability in authlib joserfc, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass an intended equality check and enabling issuer-validation bypass. This issue is fixed in version 1.7.3.
Which versions are affected by CVE-2026-75509?
How do I fix CVE-2026-75509?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-75509 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75509 exists.
Sources
Also known as CLEANSTART-2026-JQ90440, CLEANSTART-2026-ZW66973, DEBIAN-CVE-2026-75509, GHSA-r74j-q665-7rpj, UBUNTU-CVE-2026-75509.