Description
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
Published: 2026-09-03
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
Title Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
First Time appeared Redhat
Redhat ansible Automation Platform
Redhat enterprise Linux
Redhat openshift Ai
Redhat openstack
Weaknesses CWE-347
CPEs cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openstack:16.2
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat ansible Automation Platform
Redhat enterprise Linux
Redhat openshift Ai
Redhat openstack
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Redhat Ansible Automation Platform Enterprise Linux Openshift Ai Openstack
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-03T20:46:40.788Z

Reserved: 2026-09-01T10:24:25.710Z

Link: CVE-2026-84185

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T21:17:22.687

Modified: 2026-09-03T21:17:22.687

Link: CVE-2026-84185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T22:30:10Z

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature