OpenPubkey Library Signature Bypass Vulnerability in JWS Verification

A vulnerability exists in the OpenPubkey library in versions prior to 0.10.0, allowing a specially crafted JSON Web Signature (JWS) to bypass signature verification. This issue arises from the library's handling of JWS signatures, which can be exploited to undermine the integrity of the signature verification process.

Impact

Exploitation of this vulnerability allows for the bypassing of signature verification in JWS, potentially leading to unauthorized actions or the acceptance of fraudulent signatures.

Remediation

Users can upgrade to OpenPubkey version 0.10.0 or later to address this vulnerability.