CVE-2026-120459: python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key

Published Nov 2, 2026

Updated

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.

Affected Software

2 affected components

ubuntu/python-jose*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

Data Sourced

via OSV·12:00 AM

Affected Software

Frequently Asked Questions

Which deployments are exposed to token forgery?

Deployments using python-jose through 3.5.0 are exposed when JWT verification uses HS256, HS384, or HS512 and the resolved HMAC verification secret is empty. An example is an oct JWK whose k value is empty.

What does an attacker need to exploit this issue?

An attacker does not need authentication or user interaction. They need the application to accept JWTs verified with an empty HMAC key, after which they can forge tokens containing arbitrary claims that jwt.decode accepts.

Are applications using non-empty HMAC secrets affected?

The described bypass depends on the verification key resolving to an empty HMAC secret. The provided information does not indicate that tokens verified with a non-empty secret are vulnerable to this specific issue.

What can be done if an update is not immediately available?

Ensure that JWT verification cannot proceed when the HMAC secret is empty, including rejecting oct JWKs with an empty k value. Verify that configuration, secret-loading, and key-resolution failures do not fall back to an empty value.

CVE-2026-120459: python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to token forgery?

What does an attacker need to exploit this issue?

Are applications using non-empty HMAC secrets affected?

What can be done if an update is not immediately available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to token forgery?

What does an attacker need to exploit this issue?

Are applications using non-empty HMAC secrets affected?

What can be done if an update is not immediately available?