python-joseにJWT偽造の脆弱性、修正版は未確認
Summary
python-jose 3.5.0以下に、空のHMAC鍵を受け入れてJWTを偽造される脆弱性が公表されました。HS256系で検証しているPythonアプリの開発・運用者は、版と鍵の中身を確認し、修正版の有無を告知で調べてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
python-jose 3.5.0以下に、空のHMAC鍵を受け入れてJWTを偽造される脆弱性が公表されました。HS256系で検証しているPythonアプリの開発・運用者は、版と鍵の中身を確認し、修正版の有無を告知で調べてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| mpdavis | python-jose |
≤ 3.5.0 |
— |
Fix status by distribution
Fixed packages published by each distribution for this CVE Fixed versions differ by release; check each link.
- Ubuntu UBUNTU-CVE-2026-120459 python-jose
Original description The description as published by the source.
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- report github.com
- web github.com
- web github.com
- web github.com