---
id: "CVE-2026-120459"
kind: "vulnerability"
aliases: ["CVE-2026-120459"]
title: "python-jose: empty HMAC secret lets attackers forge accepted JWT tokens"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authentication", "jwt", "package", "python", "python-jose"]
not_affected_if: ["asymmetric-jwt-only", "non-empty-hmac-secret"]
published_at: "2026-11-02T15:17:29+00:00"
first_seen_at: "2026-11-02T15:24:03+00:00"
updated_at: "2026-11-02T15:25:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120459", "first_seen_at": "2026-11-02T15:24:03+00:00"}]
---

# python-jose: empty HMAC secret lets attackers forge accepted JWT tokens

python-jose accepts zero-length HMAC secrets, so when an HS256, HS384 or HS512 verification key resolves to empty, an attacker can sign tokens with arbitrary claims. The forged tokens pass jwt.decode, which means an attacker can log in as any user the application trusts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `python-jose` in the lockfile or `pip show python-jose` to find the installed version.
- Search the code for `jwt.decode` calls that use HS256, HS384 or HS512, and check where the key comes from.
- Check whether any signing key is loaded from an oct JWK or from configuration that could be an empty `k` value.

## Fix

- python-jose: fixed version unknown from the sources; the affected range is through `3.5.0`.

## Timeline

- 2026-11-02T15:24:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120459

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key

## From the sources

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_