Skip to content
OpenAdvisories

Package · Ubuntu

python-jose

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-85394

    python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

    python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when a…

    mpdavis python-jose python-jose Ubuntu