Asymmetric Key Validation Vulnerability in python-jose by mpdavis

CVE-2026-85394

What is CVE-2026-85394?

The python-jose library fails to adequately validate asymmetric keys during HMAC initialization, allowing attackers to use DER-encoded public keys that do not have the necessary PEM armor or SSH prefixes. This vulnerability enables malicious actors who possess the public key of a service to create forged HS256 tokens that can bypass verification when the algorithms are not explicitly restricted. This issue represents an incomplete resolution of a previously identified vulnerability, indicating a critical need for users to ensure that proper security measures are in place to mitigate potential risks.

References