Authentication Bypass via HMAC Key Confusion in python-jose

The python-jose library, specifically versions through 3.5.0, contains a critical vulnerability related to improper validation of asymmetric keys during HMAC initialization. The library incorrectly accepts DER-encoded public keys that lack required PEM armor or SSH prefixes. This flaw serves as an incomplete fix for the previously disclosed CVE-2024-33663. When applications using python-jose do not explicitly restrict the allowed JWT signing algorithms, an attacker in possession of the service's public key can exploit this behavior to sign malicious tokens using the HS256 algorithm. Because the library treats the public key as an HMAC secret, the forged HS256 tokens will be erroneously accepted as valid by the authentication logic, leading to total authentication bypass. This issue is highly critical for any application relying on python-jose for JWT validation where algorithmic agility is not strictly disabled.

Impact

Successful exploitation allows unauthenticated attackers to forge arbitrary JSON Web Tokens, potentially granting them administrative access or full control over user accounts. The vulnerability affects all applications incorporating python-jose versions 3.5.0 and earlier that permit JWT validation without explicitly whitelisting algorithms, placing a wide range of Python-based web services at risk of credential forgery and account takeover.

Recommendation

• Upgrade python-jose to a version that addresses CVE-2026-85394 once a patch is released by the maintainers.
• Audit all JWT validation logic to ensure that algorithms are explicitly restricted (e.g., using 'algorithms=["RS256"]') and that the library does not default to an 'auto-detect' or 'all allowed' configuration.
• Implement strict verification of incoming token headers to reject non-expected algorithms (HS256) if the service expects RSA or ECDSA signatures.