CVE-2026-120459: Authentication bypass in python-jose

python-jose up to 3.5.0: authentication bypass via empty HMAC keys, attackers forge JWT tokens.

CVE-2026-120459 is an authentication bypass vulnerability in the python-jose library (versions up to 3.5.0). The flaw allows unauthenticated attackers to forge valid JSON Web Tokens (JWT) when the HMAC verification key is empty (zero-length). This occurs because the HMACKey and CryptographyHMACKey classes accept zero-length secrets, a condition that emerges when an oct JWK has an empty k field. Attackers can thus generate tokens with arbitrary claims that jwt.decode accepts as legitimate.

The vulnerability has a CVSS score of 7.4 (high severity). The impact is direct on authentication: any application relying on python-jose to verify tokens is vulnerable if the HMAC key configuration is empty. The CVE was published on November 2, 2026, and is already circulating on social media (2 posts detected in the last 24 hours). No confirmed official patch is yet available, and no public exploits are reported as of publication.

To defend against this vulnerability, IT teams and system administrators should: (1) inventory all services and applications using python-jose; (2) verify whether the code configures empty HMAC keys or reads oct JWK configurations with empty k field; (3) prioritize review of critical authentication systems; (4) stay informed on python-jose maintainer communications and plan library upgrade once a patched version is released; (5) consider manual verification of HMAC configurations until a fix becomes available.

At a glance

What: python-jose up to version 3.5.0 accepts zero-length HMAC secrets for HS256/HS384/HS512 algorithms. When a JWK verification key is empty (oct JWK with empty k field), unauthenticated attackers can forge JWT tokens with arbitrary claims that jwt.decode accepts as valid.
Severity: CVSS score 7.4 (high severity). The vulnerability enables direct authentication bypass: attackers forge valid tokens without possessing the secret key.
Affected versions: python-jose up to version 3.5.0. Verify all versions ≤ 3.5.0 in your environments.
Fix: No official patch has been confirmed in available data. Contact python-jose maintainers and monitor official channels for updates.
Status: Published November 2, 2026. Social media signals confirm early awareness (2 posts in the last 24 hours). No evidence of active public exploitation is reported at publication.
Action: Identify all services using python-jose. Assess whether code configures empty HMAC keys or reads oct JWK with empty k field. Prioritize review of critical authentication systems. Plan urgent library upgrade when available.

Sources: NVD, CVE-2026-120459

← All articles