Description

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-10T20:17:32.113Z",
  "pubdate": "2026-09-10T20:17:32.113Z",
  "executiveSummary": "The jose package for OCaml (versions prior to 0.11.0) contains a critical cryptographic vulnerability related to improper RSA signature verification.\nThe vulnerability stems from an logic flaw where the library incorrectly assumes a signature is valid solely based on the success of the PKCS #1 decoding process.\nThe implementation fails to perform the mandatory verification step involving the RSA public key against the decoded data.\nThis represents an authentication bypass vulnerability, which allows an attacker to forge arbitrary signatures.\nBy submitting a maliciously crafted payload, an attacker can authenticate as any user or impersonate services, bypassing the intended security controls of any application relying on the jose library for JWT or RSA signature verification.\nThe impact is severe, as it completely invalidates the integrity and authenticity guarantees provided by RSA-based digital signatures within the affected library.\nNo specific attacker authentication or elevated privileges are required, provided the attacker can supply the input to the vulnerable signature validation routine.",
  "technicalDetails": "The root cause of this vulnerability is a fundamental failure in the cryptographic verification logic within the jose library's RSA implementation. In the context of RSA signature verification, the process must involve two distinct phases: decryption of the signature block using the public key (or the equivalent mathematical operation in PKCS #1 v1.5/PSS) followed by the verification of the resulting data structure against the expected hash of the payload.\nIn the affected versions of the jose package, the library performs the initial PKCS #1 decoding routine but fails to validate the outcome against the actual public key material and the message digest. Essentially, the code executes the decoding procedure and, upon verifying that the decoding process itself did not encounter a malformed data structure, prematurely terminates the verification routine and returns a 'success' state.\nThe attack flow is straightforward for an adversary. An attacker wishing to forge a token or payload merely needs to construct a binary block that satisfies the library's internal PKCS #1 decoding requirements. Because the library does not verify the signature against the public key, any arbitrary data that is correctly formatted as a PKCS #1 block will be accepted as a valid signature for the associated message.\nThe vulnerability affects all versions of the jose OCaml package before 0.11.0. This flaw renders the library incapable of performing its primary security function: verifying the authenticity and integrity of digital signatures. Any application using the library for verifying JWTs (JSON Web Tokens) or other RSA-signed data structures is directly exposed to impersonation and unauthorized access.\nThe exploitation does not require advanced access; it only requires that the attacker can provide the payload or token that the system will subsequently validate using the vulnerable library. Because the library declares the signature 'valid' based on internal structure rather than cryptographic proof, the security of the entire downstream application is compromised. There are no mitigations inherent in the library's design to prevent this, as the validation logic simply lacks the call to the RSA public key verification function.\nPost-exploitation, an attacker can achieve complete authentication bypass. If used within an OCaml web application to verify identity, an attacker could sign their own tokens with arbitrary claims (such as administrative privileges), which the library would then blindly accept as authentic, leading to full system compromise."
}