CVE-2026-89086
CRITICAL · 9.1 EPSS 0.2%Real flaw but unverified "public exploit" claims; no PoC evidence, not KEV-listed, recycled posts dominate signal.
What: OCaml jose package (before 0.11.0) RSA signature validation bypass—accepts signatures without verifying the public key, allowing signature forgery. CVSS 9.1 (CRITICAL).
Why it matters: Chatter claims "public exploit" but no PoC link or working code visible in posts. Not KEV-listed yet. Social signal is repetitive automated aggregation (identical posts from multiple accounts); posts reference "abyssal" severity tag and claim public exploit without substantiation. Real vulnerability—improper cryptographic validation is severe—but social noise lacks evidence of active weaponization or defender triage.
Where it's seen: Bluesky feeds dominated by near-duplicate posts from CVE aggregators (vulnsea, stemshop). One post (7) clarifies impact (forged signatures). No vendor advisories, PoCs, or defender questions visible.
RISK: HIGH — RSA signature bypass in crypto library; limited OCaml ecosystem footprint reduces attack surface.
Description
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None