Improper Validation of Syntactic Correctness of Input Affecting joserfc package, versions [,1.7.2)

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input due to permissive urlsafe_b64decode handling in src/joserfc/util.py. An attacker can make a signed JWT validate under an alternate textual form by appending trailing = padding to the compact token or one of its segments. This lets the same token be represented by multiple encodings, which can defeat token revocation or anti-replay checks when an application tracks JWTs or token hashes by their exact string form. Users see otherwise identical authentication tokens accepted even after the original encoding has been denied.

Notes

• joserfc only treated + and / as invalid in urlsafe_b64decode; padded base64url text with = was still accepted, so the issue applied to any code path that reused that shared decoder, not just one JWT parser entrypoint.
• The maintainer's advisory’s practical impact is strongest for deployments that key deny-lists or replay checks on the exact compact JWT string or its hash; equivalent padded encodings can bypass those comparisons even when the underlying signed content is unchanged.

• GitHub Commit 1.7.2
• Maintainer's Advisory