authlib/joserfc Security Advisories | GitStock

high2026-07-02

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

GHSA-gg9x-qcx2-xmrh · CVE-2026-49852

medium2026-06-26

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

GHSA-wphv-vfrh-23q5 · CVE-2026-48990

high2026-03-02

joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

GHSA-w5r5-m38g-f9f9 · CVE-2026-27932

critical2025-11-18

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

GHSA-frfh-8v73-gjg4 · CVE-2025-65015