OCaml jose package RSA signature bypass (CVE-2026-89086, CVSS 9.1)

🕵️ RESEARCH & DEEP DIVES

• OCaml jose package RSA signature bypass (CVE-2026-89086, CVSS 9.1)
  The jose package for OCaml accepts forged RSA signatures because it validates only PKCS #1 decoding without public key verification.

  • Affects applications using the jose package for OCaml to verify RSA signatures on tokens, signed configurations, or other integrity-protected data.
  • Versions before 0.11.0 are vulnerable (CVE-2026-89086, CVSS 9.1, critical).
  • Verification only checks that PKCS #1 decoding succeeds and skips the public key check, so any decodable signature is accepted as valid.
  • Attackers can craft signatures that pass decoding without being produced by the legitimate private key; no public PoC at time of writing.
  • Fixed in jose 0.11.0 for OCaml.
  Sources 📎 Coverage: thehackerwire.com · 👁 via thehackerwire.com (discovered)

• Mandiant Founder Kevin Mandia Joins Amazon Board — SecurityWeek

• September Windows Server updates break Remote Desktop Services — BleepingComputer

• Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data — Dark Reading

• Conti ransomware crew member sentenced to four years in prison — CyberScoop

• Hawley probes OpenAI over Hugging Face breach — CyberScoop

• AI lets small actors run state-level hacking campaigns, Anthropic report finds — CyberScoop

• Forgejo before 16.0.4 allows remote code execution via a crafted template rep... — CVE ThreatInt

• Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Ph... — CVE ThreatInt

• Suricata detect/transform: use-after-free in decompress transformsSuricata is... — CVE ThreatInt

• OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_... — CVE ThreatInt

• Suricata detect/transform: use-after-free in dotprefix transformSuricata is a... — CVE ThreatInt

• Authenticated Directory Traversal Vulnerability in File Upload Functionality ... — CVE ThreatInt

• Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 a... — CVE ThreatInt

• OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostAn ... — CVE ThreatInt

• isomorphic-git before 1.42.0 Prototype Pollution via getRemoteInfoisomorphic-git b... — CVE ThreatInt

• The cstruct package before 6.3.0 for OCaml mishandles indexes. — CVE ThreatInt

• In the jose package before 0.11.0 for OCaml, library calls to validate an RSA... — CVE ThreatInt

• OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticat... — CVE ThreatInt

• Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot d... — CVE ThreatInt

• OmniRoute ACP Custom-Agent Remote Code Execution (RCE)OmniRoute is an open-so... — CVE ThreatInt

• career-ops: Local dashboard API accepted cross-origin and non-loopback reques... — CVE ThreatInt

• Angular: SSR XSS via Unescaped Content Across DocumentFragment Bou... — CVE ThreatInt

• Angular: Information Leak via HttpTransferCache Bypass When Using `withRequ... — CVE ThreatInt

• Consul-template vulnerable to an information disclosure issue in error handli... — CVE ThreatInt

• Consul vulnerable to an authorization bypass in the Connect service meshConsu... — CVE ThreatInt

• We've got one word for it, and it's usually the wrong one — Cisco Talos

• Conti member gets 4 years in prison https://www. — @campuscodi@mastodon.social

• KEV: CVE-2026-67277 — MikroTik RouterOS — MikroTik RouterOS Missing Authentication for Critical Function Vulnerability — CISA KEV

• The SOC 2 Trap: Why Compliance Belongs on the Platform, Not in a Spreadsheet — securityboulevard.com (discovered)