CVE-2026-84185: Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
A flaw was found in jwcrypto. When verifying a General JSON Serialization JWS using a JWKSet, the library does not correctly apply the current signature kid header when selecting the verification key. The root cause is located in jwcrypto/jws.py, where the code incorrectly evaluates the joseheader as a dictionary when it is actually a list for General JSON JWS objects. Consequently, the library may iterate through every key in the supplied JWKSet and accept a signature made by a different key than the one identified by the kid header.
An attacker who possesses a valid signing key within the application's trusted JWKSet can exploit this flaw to bypass kid-based authorization bindings. This allows the attacker to perform actions such as impersonating other tenants, accessing unauthorized data, or escalating privileges in applications that rely on the kid claim for security decisions.
Other sources
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications are exposed when they verify General JSON Serialization JWS objects with a JWKSet and use the signature's kid value to bind authorization, tenancy, identity, or privileges to a particular key.
What does an attacker need to exploit the flaw?
The attacker must possess a valid signing key that is already present in the application's trusted JWKSet. Exploitation relies on submitting a General JSON JWS whose signature is accepted under a different trusted key than the key identified by its kid header.
What is the practical security impact?
In applications that make security decisions based on kid, the flaw can bypass those key bindings. The described outcomes include impersonating other tenants, accessing unauthorized data, and escalating privileges.
Are all JWS verification uses affected?
The issue is described specifically for verification of General JSON Serialization JWS objects using a JWKSet. The provided information does not establish impact for other JWS serialization formats or verification configurations.