python-jose authentication bypass via empty HMAC key

Summary

python-jose through 3.5.0 accepts zero-length HMAC secrets, so unauthenticated attackers can forge tokens that it accepts.

Affected when

• HMAC verification key is empty (e.g. oct JWK with empty k)

What to do

Check that you run a python-jose version newer than 3.5.0 and read the vendor's advisory. The sources name no fixed version.

Products and platforms

• python-jose

CVE IDs

• CVE-2026-120459 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC