Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:python-Jose_project:python-Jose:*:*:*:*:*:*:*:*

1 brief RSS
critical advisory

Authentication Bypass via HMAC Key Confusion in python-jose

The python-jose library version 3.5.0 and earlier fails to validate asymmetric keys during HMAC initialization, allowing attackers with a public key to forge HS256 JWT tokens.

python-jose authentication-bypass jwt-forgery dependency-vulnerability
2c