This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-120459 →
Unrated
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and Cryp...
UBUNTU-CVE-2026-120459
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Ubuntu:22.04:LTS | python-jose |
All versions |
— |
| Ubuntu:24.04:LTS | python-jose |
All versions |
— |
Original description The description as published by the source.
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report github.com
- report vulncheck.com