python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.
Summary
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mpdavis | python-jose | up to 3.5.0 | — | No fix listed | CNA |
| — | python-jose (PyPI) | up to 3.5.0 | — | No fix listed | GHSA-3qf3-8w2g-rqmx |
- python-jose Vendormpdavis Affected up to 3.5.0 Fixed in — No fix listed CNA
- python-jose (PyPI) Vendor— Affected up to 3.5.0 Fixed in — No fix listed GHSA-3qf3-8w2g-rqmx
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Not affected: 1 product
- Red Hat Ansible Automation Platform 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-85394
- 2026-10-03 Alias added: GHSA-3qf3-8w2g-rqmx
- 2026-10-06 Affected versions changed · GHSA-3qf3-8w2g-rqmx
- 2026-10-06 CVSS score added · GHSA-3qf3-8w2g-rqmx
- 2026-10-06 Weakness changed · GHSA-3qf3-8w2g-rqmx
- 2026-10-06 6 new references · GHSA-3qf3-8w2g-rqmx
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-06 CVSS score added · Red Hat
- 2026-10-07 Affected versions changed · Red Hat
References
Advisory 2
More mpdavis vulnerabilities
- TI-2026-83851 Authentication bypass in python-jose lets attackers forge JWTs CVSS 4.0CRITICAL 9.1
Sources
- CVE-2026-85394 · CVE Program
- CVE-2026-85394 · NVD
- FIRST EPSS
- GHSA-3qf3-8w2g-rqmx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-85394 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences