{"id":"CVE-2026-120459","kind":"vulnerability","aliases":["CVE-2026-120459"],"related":[],"title":"python-jose: empty HMAC secret lets attackers forge accepted JWT tokens","description":"python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.","summary":"python-jose accepts zero-length HMAC secrets, so when an HS256, HS384 or HS512 verification key resolves to empty, an attacker can sign tokens with arbitrary claims. The forged tokens pass jwt.decode, which means an attacker can log in as any user the application trusts.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","jwt","package","python","python-jose"],"not_affected_if":["asymmetric-jwt-only","non-empty-hmac-secret"],"how_to_check":"- Look for `python-jose` in the lockfile or `pip show python-jose` to find the installed version.\n- Search the code for `jwt.decode` calls that use HS256, HS384 or HS512, and check where the key comes from.\n- Check whether any signing key is loaded from an oct JWK or from configuration that could be an empty `k` value.","fix":"- python-jose: fixed version unknown from the sources; the affected range is through `3.5.0`.","status":"open","published_at":"2026-11-02T15:17:29+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","triaged_at":"2026-11-02T15:25:44+00:00","updated_at":"2026-11-02T15:25:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:25:44Z","model":"claude-haiku-5-5","output":{"fix":"- python-jose: fixed version unknown from the sources; the affected range is through `3.5.0`.","reach":"internet","title":"python-jose: empty HMAC secret lets attackers forge accepted JWT tokens","impact":"high","summary":"python-jose accepts zero-length HMAC secrets, so when an HS256, HS384 or HS512 verification key resolves to empty, an attacker can sign tokens with arbitrary claims. The forged tokens pass jwt.decode, which means an attacker can log in as any user the application trusts.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","python-jose","jwt","authentication"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker forges tokens and logs in as any user","analyst_note":"Confirm the fixed python-jose version and whether a default configuration can produce an empty HMAC key; check the vulncheck advisory linked in the sources.","how_to_check":"- Look for `python-jose` in the lockfile or `pip show python-jose` to find the installed version.\n- Search the code for `jwt.decode` calls that use HS256, HS384 or HS512, and check where the key comes from.\n- Check whether any signing key is loaded from an oct JWK or from configuration that could be an empty `k` value.","plain_action":"","needs_analyst":true,"not_affected_if":["asymmetric-jwt-only","non-empty-hmac-secret"],"who_is_affected":"Applications that use python-jose to verify HS256, HS384 or HS512 tokens are exposed when the verification key can resolve to an empty value, for example an oct JWK with an empty k. Applications that use asymmetric algorithms or always supply a non-empty secret are not described as affected. The sources do not say whether a default configuration produces an empty key.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000753,"input_tokens":4192,"output_tokens":668,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120459':15A,18A '-2026':14A,17A '3.5.0':77C 'accept':10A,29B,94C,127C 'allow':84C 'applic':71B,102C 'arbitrari':53B,123C 'attack':8A,48B,63B,86C,118C 'authent':19B,80C 'bypass':81C 'claim':54B,124C 'contain':78C 'cryptographyhmackey':93C 'cve':13A,16A 'empti':4A,46B,109C,116C 'forg':9A,56B,88C,120C 'hmac':5A,33B,98C 'hmackey':91C 'hs256':38B 'hs256/hs384/hs512':104C 'hs384':39B 'hs512':41B 'jose':3A,25B,28B,75C 'jwk':114C 'jwt':11A,20B 'jwt.decode':59B,126C 'jwts':89C 'k':117C 'key':43B,106C 'length':32B,97C 'let':7A 'log':65B 'mean':61B 'oct':113C 'packag':21B 'pass':58B 'python':2A,22B,24B,27B,74C 'python-jos':1A,23B,26B,73C 'resolv':44B,107C 'secret':6A,34B,99C 'sign':50B 'token':12A,51B,57B,121C 'trust':72B 'unauthent':85C 'user':69B 'verif':42B,105C 'vulner':82C 'zero':31B,96C 'zero-length':30B,95C","nicknames":[],"mitigations":[],"who_affected":"Applications that use python-jose to verify HS256, HS384 or HS512 tokens are exposed when the verification key can resolve to an empty value, for example an oct JWK with an empty k. Applications that use asymmetric algorithms or always supply a non-empty secret are not described as affected. The sources do not say whether a default configuration produces an empty key.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","critical","jwt","package","python","pythonjose"],"first_public_at":"2026-11-02T15:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120459","severity":null,"published_at":"2026-11-02T15:17:29+00:00","modified_at":"2026-11-02T15:17:29+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","fetched_at":"2026-11-02T15:24:03+00:00","note":null}],"documents":[{"id":52516,"url":"https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}