CVE-2026-65632 | potatosalad Jose up to 1.11.12 ECDSA Signature Verification jose_jwk_kty_ec.erl jose_jwk_kty_ec:verify authentication replay

October 26, 2026 Yanac

A vulnerability described as critical has been identified in potatosalad Jose up to 1.11.12. The impacted element is the function jose_jwk_kty_ec:verify of the file src/jwk/jose_jwk_kty_ec.erl of the component ECDSA Signature Verification. Such manipulation leads to authentication bypass by capture-replay.

This vulnerability is referenced as CVE-2026-65632. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More