Authentication bypass in the joserfc Python library (CVE-2026-49852)

CVE-2026-49852 is an authentication bypass vulnerability in the joserfc Python library where `joserfc.jwt.decode` accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or `None`. Because `OctKey.import_key` only emits a `SecurityWarning` for keys shorter than 14 bytes without rejecting zero-length input, an attacker with no knowledge of the application's secret can forge arbitrary JWT claims by signing with an empty key, fully bypassing authentication on any endpoint whose JWT secret resolves to `""` or `None` at runtime. Public POC available. Affected versions: - <= 1.6.7 We recommend updating to: 1.6.8. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh Details: https://vuln.today/cve/CVE-2026-49852