joserfc is a Python library that implements several JSON Object Signing and Encryption standards. An attacker who does not possess a signing key can exploit a code path in deserialize_json() by submitting a JWS General JSON Serialization that contains an empty signatures array. Because the verification loop iterates zero times, the function returns success, letting the attacker supply any payload that the application may later assume is authentic. This effectively bypasses authentication checks and allows unauthorized data to be accepted as valid, potentially enabling data tampering or privilege escalation in downstream services.

The vulnerability affects the authlib:joserfc library version before 1.7.4. Systems that import joserfc to deserialize JWS General JSON Serialization and rely on signature verification are at risk. Compact and flattened JWS formats, as well as JWE processing, are unaffected.

The CVSS score of 9.1 indicates a severe impact, but the EPSS value of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. If an application accepts JWS payloads from untrusted sources, an attacker could craft a token with an empty signatures array and have the application trust the contained payload, effectively subverting authentication and potentially leading to unauthorized access or data manipulation. The threat is mitigated only by ensuring the library is updated or by preventing the vulnerable code path.