{"id":"CVE-2026-65629","kind":"vulnerability","aliases":["CVE-2026-65629"],"related":[],"title":"jose (Erlang): weak password key derivation exposes exported private keys to cracking","description":"Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.\n\nWhen jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.\n\nBoth values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.\n\nThis issue affects jose: from 1.10.0 before 1.11.13.","summary":"When jose exports a password-encrypted private key, it hardcodes PBKDF2-HMAC-SHA256 with only 2048 iterations and an 8-byte salt, far below current guidance. An attacker who obtains an exported key blob can crack the export password offline and recover the full private key.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","erlang","jose","jwt","package"],"not_affected_if":["default-config","no-password-key-export"],"how_to_check":"- Check the jose version in the project's lock file (for example `rebar.lock` or `mix.lock`) and see whether it falls in `1.10.0` to before `1.11.13`\n- Search the codebase and backups for code calling `jose_jwk:to_der/2` or `JOSE.JWK.to_der/2` with a password","fix":"- Upgrade jose to `1.11.13` or later\n- Rotate any private keys that were exported with a password while an affected version was in use, since exported blobs may already be exposed","status":"open","published_at":"2026-10-26T20:17:58+00:00","first_seen_at":"2026-10-26T20:50:18+00:00","triaged_at":"2026-10-26T20:51:37+00:00","updated_at":"2026-10-26T20:51:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T20:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade jose to `1.11.13` or later\n- Rotate any private keys that were exported with a password while an affected version was in use, since exported blobs may already be exposed","reach":"local","title":"jose (Erlang): weak password key derivation exposes exported private keys to cracking","impact":"high","summary":"When jose exports a password-encrypted private key, it hardcodes PBKDF2-HMAC-SHA256 with only 2048 iterations and an 8-byte salt, far below current guidance. An attacker who obtains an exported key blob can crack the export password offline and recover the full private key.","category":"package","nicknames":[],"who_cares":["erlang","elixir","jose","jwt"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker cracks export password and recovers the private key","analyst_note":"","how_to_check":"- Check the jose version in the project's lock file (for example `rebar.lock` or `mix.lock`) and see whether it falls in `1.10.0` to before `1.11.13`\n- Search the codebase and backups for code calling `jose_jwk:to_der/2` or `JOSE.JWK.to_der/2` with a password","needs_analyst":false,"not_affected_if":["default-config","no-password-key-export"],"who_is_affected":"Applications that use the jose Erlang/Elixir library at versions from `1.10.0` before `1.11.13` and that export private keys encrypted with a password. Exposure requires that an exported blob leaks from a backup, repository, storage bucket or log. Projects that only verify tokens or never export password-protected keys can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":3730,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-256':237C '-65629':15A,18A '000':192C '1.10.0':303C '1.11.13':305C '128':206C '16':241C '2048':41B,161C '300':217C '600':191C '64':166C '8':45B,140C,164C 'across':231C 'ae':236C 'affect':247C,300C 'allow':84C 'attack':53B,86C,108C,257C,286C 'backup':269C 'binary/3':130C 'bit':167C,207C 'blob':59B,264C 'brute':284C 'brute-forc':283C 'byte':46B,165C,242C 'caller':177C 'cbc':238C 'cheap':279C 'comput':78C 'configur':270C 'cost':228C 'count':159C 'crack':12A,61B,107C 'current':50B,183C 'cve':13A,16A 'der':128C 'der/2':122C,124C 'deriv':6A,150C,254C 'dictionari':281C 'effort':79C 'elixir':19B 'encrypt':30B,92C,115C,235C 'encryptedprivatekeyinfo':141C 'entir':251C 'erlang':2A,20B 'exampl':266C 'export':8A,26B,57B,63B,96C,111C,263C,289C 'expos':7A 'factor':214C 'far':48B,181C 'forc':285C 'full':69B,295C 'function':131C 'guidanc':51B,184C 'hardcod':34B,147C 'hash':75C 'hmac':37B,154C,197C 'insuffici':77C 'intend':221C 'issu':299C 'iter':42B,158C,193C 'iv':244C 'jose':1A,21B,25B,82C,110C,119C,126C,301C 'jose.jwk.to':123C 'jwk':120C,127C 'jwt':22B 'key':5A,10A,32B,58B,71B,95C,101C,117C,136C,149C,211C,232C,297C 'key-deriv':148C 'key-stretch':210C 'least':205C 'librari':83C 'log':275C 'lower':219C 'mount':277C 'neither':170C 'nist':200C 'object':272C 'obtain':55B,88C,259C 'offlin':65B,104C,280C 'one':260C 'order':189C 'overridden':174C 'owasp':185C 'packag':23B 'paramet':151C 'password':4A,29B,64B,74C,91C,106C,114C,290C 'password-crack':105C 'password-encrypt':28B,90C,113C 'pbes2':144C 'pbkdf2':36B,153C,196C 'pbkdf2-hmac-sha256':35B,152C,195C 'pkcs':139C 'precomput':230C 'privat':9A,31B,70B,94C,100C,116C,296C 'private-key':93C 'random':168C,243C 'recommend':186C,201C 'recov':67B,98C 'reduc':226C 'repositori':271C 'rough':216C 'salt':47B,169C,202C,225C 'scheme':145C 'serial':134C 'sha256':38B,155C,198C 'short':224C 'src/jwk/jose_jwk_der.erl':133C 'storag':273C 'strength':255C 'stretch':212C 'success':292C 'symmetr':234C 'time':218C 'use':72C,142C 'valu':171C,179C 'weak':3A,249C 'work':213C 'yield':293C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the jose Erlang/Elixir library at versions from `1.10.0` before `1.11.13` and that export private keys encrypted with a password. Exposure requires that an exported blob leaks from a backup, repository, storage bucket or log. Projects that only verify tokens or never export password-protected keys can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65629","severity":null,"published_at":"2026-10-26T20:17:58+00:00","modified_at":"2026-10-26T20:17:58+00:00","first_seen_at":"2026-10-26T20:50:18+00:00","fetched_at":"2026-10-26T20:50:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}