CVE-2026-120459 — Vulnerability intelligence

mpdavis — python-jose

Published: 2026-11-02T14:29:15.767Z

CVSS

9.1

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.

Sources

• CVE-2026-120459
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-120459