Skip to content
Threat Feed
Subscribe

Product

Python-Jose (<= 3.5.0)

1 brief RSS
critical advisory

Authentication Bypass via HMAC Key Confusion in python-jose

The python-jose library version 3.5.0 and earlier fails to validate asymmetric keys during HMAC initialization, allowing attackers with a public key to forge HS256 JWT tokens.

python-jose authentication-bypass jwt-forgery dependency-vulnerability
2c