python-jose: Authentication bypass via JWT forgery (CVE-2026-120459)
The python-jose library through version 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs by exploiting the librarys acceptance of zero-length HMAC secrets.
CVE search metadata
CVE search record: CVE-2026-120459. Severity: high. CVSS: 7.4. KEV: no. Product: python-jose (<= 3.5.0). Brief: python-jose: Authentication bypass via JWT forgery (CVE-2026-120459). Brief link: https://feed.craftedsignal.io/briefs/2026-11-python-jose-auth-bypass/
Triage facts
Revision 1- Applicability
- python-jose (<= 3.5.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 15:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-120459 describes an authentication bypass vulnerability in python-jose versions 3.5.0 and earlier. The flaw exists in the HMACKey and CryptographyHMACKey implementations, which incorrectly accept zero-length HMAC secrets during JWT verification. If an application relies on these methods to verify HS256, HS384, or HS512 tokens and the verification key resolves to an empty value (or an octet JWK with an empty 'k' parameter), an attacker can successfully forge tokens containing arbitrary claims that are accepted by jwt.decode.
Impact
Successful exploitation allows an unauthenticated attacker to bypass authentication mechanisms and impersonate arbitrary users by forging validly signed JWTs.
Recommendation
Update to the latest version of python-jose where the fix is implemented. Until an upgrade is possible, audit application code to ensure that HMAC verification keys are strictly validated for non-zero length before being passed to the library.
Immediate actions
Identify applications using python-jose versions <= 3.5.0 in the dependency inventory
Threat Hunt
Identify applications performing JWT validation using python-jose that log empty or unexpected HMAC secret configurations
Data: Application audit logs, Source code analysis
Mitigations
Upgrade python-jose to a version where CVE-2026-120459 is patched
CVE-2026-120459