CVE-2026-120459
High · 7.4CVSS
7.4
EPSS
0.3%
Published
Nov 2, 2026
CISA due date
—
The record
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-91899 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper… CWE-347
- CVE-2026-91898 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper… CWE-347
- CVE-2026-91908 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of… CWE-347
- CVE-2026-91905 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of… CWE-347
- CVE-2026-117549 @fastify/secure-session is a session plugin for Fastify that stores an encrypted session… CWE-347
- CVE-2026-116474 The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system… CWE-347
- CVE-2026-63182 LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization… CWE-347
- CVE-2026-46560 Open Access Management (OpenAM) is an access management solution. CWE-347