Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-120459: python-jose library enables creation of forged sign‑in tokens
CVE-2026-120459 · published 2 days ago
Summary
The python-jose Python library, up to version 3.5.0, can accept an empty secret when it checks signed tokens that prove a user’s identity. Because of this, anyone can craft a token that the application will treat as genuine, giving them unauthorized access. Fix it by updating to a newer version of the library or ensuring the secret key is never left empty, and consider using a more robust verification method.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mpdavis | python-jose | <= 3.5.0 |
| Ubuntu:22.04:LTS | canonical | python-jose | All versions |
Original advisory text
python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.
References
- https://github.com/mpdavis/python-jose/issues/398 Third Party Advisory
- https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py Third Party Advisory
- https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_bac... Third Party Advisory
- https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-by... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-1204... Vendor Advisory
- https://github.com/mpdavis/python-jose Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-120459 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-120459 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-120459 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.1
Critical
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-120459 · NVD
CVE-2026-120459 · MITRE
CVE-2026-120459 · OSV
UBUNTU-CVE-2026-120459 · OSV
Track software like this
Free during beta