PT-2026-85227 · Pypi · Python-Jose
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
python-jose versions prior to 3.5.1
Description
The software fails to properly validate asymmetric keys during HMAC initialization. It accepts DER-encoded public keys that lack PEM armor or SSH prefixes. This allows an attacker who possesses the service's public key to forge HS256 tokens that pass verification if the algorithms are not explicitly restricted. DER (Distinguished Encoding Rules) is a binary representation of data structures used in certificates and keys.
Recommendations
Update python-jose to version 3.5.1 or later.
Exploit
Fix
Improper Verification of Cryptographic Signature
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Python-Jose