CVE-2026-120459

The python-jose library, version 3.5.0 and below, is vulnerable to an authentication bypass because the HMACKey and CryptographyHMACKey components accept zero-length HMAC secrets. If an application's HS256, HS384, or HS512 verification key resolves to an empty value (e.g., an oct JWK with an empt...