CVE-2026-120459
📛 CVE Title
python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key
Description
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulnCheck
- CVSS severity
- CRITICAL
- CVSS score
- 9.1 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Effective score
- 9.1 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-347 - Reserved
- 2026-11-02
- Published
- 2026-11-02 14:29 UTC
- Last updated
- 2026-11-02 14:29 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120459.json
- Linked Threat
- CVE-2026-120459 — python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-115219
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| mpdavis | python-jose |
0 (affected)
|
— |
Vendor references (4)
References embedded in the original CVE record by the assigning CNA.
- https://github.com/mpdavis/python-jose/issues/398 issue-tracking
- https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py technical-description
- https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_backend.py technical-description
- VulnCheck Advisory: python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key third-party-advisory
MITRE references (4) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_backend.py technical-description
- https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py technical-description
- https://github.com/mpdavis/python-jose/issues/398 issue-tracking
- VulnCheck Advisory: python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key third-party-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (19)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.aikido.dev
None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.
2026-11-03 11:19 UTC -
web:blogs.oracle.com
For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-11-03 11:19 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-11-03 11:19 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-11-03 11:19 UTC -
web:www.openhands.dev
Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.
2026-11-03 11:19 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-11-03 11:19 UTC -
web:source.android.com
This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.
2026-11-03 11:19 UTC -
web:www.oracle.com
Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.
2026-11-03 11:19 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-03 11:19 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-11-03 10:05 UTC -
web:www.veeam.com
Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1 Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line ...
2026-11-03 10:05 UTC -
web:crimsondesert.pearlabyss.com
Fellow Greymanes, Here are the fixes and improvements that have been added this patch . Update ScheduleThe patch is rolling out across all platforms. Please refer to the Update section below to see the state of the patch for each platform. UpdateSteam (PC): Patch available now Steam (Mac): Patch ...
2026-11-03 10:05 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-11-03 10:05 UTC -
web:sec.cloudapps.cisco.com
The right column indicates whether a release is affected by the vulnerabilities that are described in this advisory and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
2026-11-03 10:05 UTC -
web:securityonline.info
Oracle Critical Patch Update for October 2026 fixes 1,209 CVEs , including six CVSS 10.0 bugs such as CVE - 2026 -101809 in E-Business Suite.
2026-11-03 10:05 UTC -
web:support.esri.com
This patch deals specifically with the issues listed below under Issues addressed with this patch . As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and Uninstalling ...
2026-11-03 10:05 UTC -
web:www.cisa.gov
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...
2026-11-03 10:05 UTC -
web:www.microsoft.com
Resources you patch manually: nothing is installed automatically for you. Apply the updates now, starting with internet-facing systems, and then restart or reimage. Software you installed or bundled: you update it no matter how you patch . Rebuild and redeploy containers and custom images.
2026-11-03 10:05 UTC -
web:www.oracle.com
Text Form of Oracle Critical Patch Update - October 2026 Risk Matrices This document provides the text form of the October 2026 Advisory Risk Matrices. Please note that the CVE IDs in this document correspond to the same CVE IDs in the October 2026 Advisory. This page contains the following text format Risk Matrices: Oracle Database Server ...
2026-11-03 10:05 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-120459.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/python-jose",
"product": "python-jose",
"repo": "https://github.com/mpdavis/python-jose",
"vendor": "mpdavis",
"versions": [
{
"lessThanOrEqual": "3.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gavin Blacklock"
},
{
"lang": "en",
"type": "finder",
"value": "Conner Webber"
}
],
"datePublic": "2026-03-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:15.767Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/mpdavis/python-jose/issues/398"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_backend.py"
},
{
"name": "VulnCheck Advisory: python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key"
}
],
"title": "python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120459",
"datePublished": "2026-11-02T14:29:15.767Z",
"dateReserved": "2026-11-02T12:42:23.406Z",
"dateUpdated": "2026-11-02T14:29:15.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}