ocaml-jose EUVD-2026-75708

Exploitation requires that the target application uses ocaml-jose before 0.11.0 to verify RSA-signed (RSASSA-PKCS1, e.g. RS256) JWS/JWT tokens and trusts the verification result for authentication or authorization; the attacker must be able to submit a token to that verification path (typical for any network-facing token-accepting endpoint). No valid signature, private key, credentials, or user interaction is needed - the attacker only needs to produce a token whose signature block is PKCS #1-decodable. Limiting factors are deployment-specific: applications using HMAC/EC algorithms via other code paths, or not relying on ocaml-jose's RSA verification, are not exposed, and the overall attack surface is bounded by the library's niche OCaml user base.

This is a genuine high-priority cryptographic defect rather than an inflated high-CVSS score: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes remote, unauthenticated, low-complexity exploitation with high confidentiality and integrity impact, and the code diff confirms the verification step was entirely absent, so the vector is consistent with the evidence. Because a forged token is accepted as authentic, this collapses whatever authentication or authorization any consuming application built on top of JWS - the practical impact is full authentication bypass and impersonation of any principal, which is why even a mid-sized municipal IT team in mielec running an OCaml service that trusts these tokens should treat patching as urgent. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active exploitation yet; the risk is driven by exploit simplicity and the severity of consequence rather than by observed attacks. The only mitigating factor is deployment footprint: ocaml-jose is a niche library, so exposure is limited to the specific OCaml applications that use it for token verification.

An attacker crafts a JWT with a chosen payload (for example, an admin identity or elevated scopes) and attaches a signature blob that merely decodes under PKCS #1 rather than one produced with the legitimate private key. A service using ocaml-jose before 0.11.0 accepts the token as valid because it never runs the RSA public-key check, granting the attacker authenticated access. No credentials or user interaction are required, and no public POC has been published.