Authentication Bypass Vulnerability in python-jose Product by Vendor Python-Jose

CVE-2026-120459

What is CVE-2026-120459?

The python-jose library, up to version 3.5.0, is susceptible to an authentication bypass flaw that enables unauthenticated attackers to forge JSON Web Tokens (JWTs). This vulnerability arises because the HMACKey and CryptographyHMACKey components can accept zero-length HMAC secrets. In scenarios where an application's HS256/HS384/HS512 verification key resolves to an empty state—such as an octet JSON Web Key (JWK) with an empty key parameter—attackers can exploit this weakness to create tokens containing arbitrary claims that can be accepted by jwt.decode.

References