Skip to content
OpenAdvisories

Product · mpdavis

python-jose

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-120459

    python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key

    python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key res…

    mpdavis python-jose python-jose Ubuntu