CVE-2026-120459

Name of the Vulnerable Software and Affected Versions python-jose versions prior to 3.5.1

Description An authentication bypass exists because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256, HS384, or HS512 verification key resolves to empty, such as an oct JWK (JSON Web Key) with an empty k variable, unauthenticated attackers can forge JSON Web Tokens (JWTs) with arbitrary claims that jwt.decode() will accept.

Recommendations versions prior to 3.5.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Reject empty keys at configuration load.