CVE-2026-120459

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK wit...

CVE-2026-120459

The python-jose library, version 3.5.0 and below, is vulnerable to an authentication bypass because the HMACKey and CryptographyHMACKey components accept zero-length HMAC secrets. If an application's HS256, HS384, or HS512 verification key resolves to an empty value (e.g., an oct JWK with an empt...

EUVD-2026-115219

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK wit...