Read the docs
TI-2026-83851 Aliases CVE-2026-120459GHSA-7jv8-hwmh-86qc

Authentication bypass in python-jose lets attackers forge JWTs

Priority LOW 39CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

python-jose through 3.5.0 accepts zero-length HMAC secrets in HMACKey and CryptographyHMACKey, so it fails to verify JWT signatures properly (CWE-347). When an application's HS256, HS384 or HS512 verification key resolves to empty, such as an oct JWK with an empty k, an unauthenticated remote attacker can forge tokens with arbitrary claims that jwt.decode accepts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.

Why it matters now

EPSS 0.00251 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mpdavispython-joseup to 3.5.0—No fix listedCNA
  • python-jose Vendormpdavis Affected up to 3.5.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for python-jose.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120459
  2. 2026-11-02 Alias added: GHSA-7jv8-hwmh-86qc
  3. 2026-11-04 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-58602 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences