CVE-2026-84185

MediumCVSS 5.9/10Last modified Nov 6, 2026

Description

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—

References

Timeline

Published: Sep 3, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-841866.9Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address CVE-2026-841878.2AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary CVE-2026-841884.8LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which CVE-2026-841898.1LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integratio CVE-2026-84194.3The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due t CVE-2026-841907.2LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration paramet CVE-2026-841916.1LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and CVE-2026-841927.1LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sour CVE-2026-841935.8LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced CVE-2026-841948.6LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery CVE-2026-841957.7Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mo CVE-2026-841967.7Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send ar