CVE-2026-85394: python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to token forgery?
Deployments using python-jose through 3.5.0 are exposed when token verification does not explicitly restrict accepted algorithms. An attacker who has the service's public key can forge HS256 tokens that pass verification.
Does exploitation require credentials or user interaction?
No. The supplied severity vector specifies network access, low attack complexity, no privileges required, and no user interaction.
What configuration change can reduce exposure before an update is available?
Explicitly restrict the algorithms accepted during token verification. The described forgery succeeds when algorithms are not explicitly restricted.
What key format is relevant to this issue?
The affected HMAC initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes. This enables a public key to be treated as an HMAC secret.