jOSerfc, a Python JOSE implementation, incorrectly accepts JWTs that contain trailing padding characters (==) which are non‑conforming to the standard. This flaw allows an attacker to modify the token signature or payload in a way that still verifies correctly when processed by jOSerfc. Depending on how the application uses the token, this could permit bypassing token revocation lists or anti‑replay protections that rely on strict token integrity. The vulnerability is rooted in a weakness identified as CWE‑1286 and CWE‑345.

The issue affects the Authlib project's jOSerfc component in versions up to 1.7.1. Systems that include this library, such as Red Hat Hummingbird deployments, are susceptible. The flaw was fixed in jOSerfc 1.7.2.

The CVSS score of 2.3 indicates a low overall severity, and the EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a malicious actor submitting a crafted JWT with padding to an application that uses jOSerfc to verify the token; no special privileges or network exposure are required beyond the ability to supply tokens to the target application.