What is CVE-2026-120459 in python-jose?

CVE-2026-120459 is a critical authentication bypass vulnerability affecting python-jose through version 3.5.0. According to la librería zip de Rust y otros reportes, los problemas en bibliotecas de autenticación requieren revisiones exhaustivas. Como se detalla en la escalada de permisos en Java, las fallas lógicas pueden derivar en graves riesgos.

The flaw occurs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256, HS384, or HS512 verification key resolves to empty, such as an oct JWK with an empty k parameter, attackers can exploit the weakness.

This security issue shares similarities with la escalada de privilegios local, donde un control deficiente permite accesos no autorizados.

How does the authentication bypass work?

Unauthenticated attackers can forge JSON Web Tokens with arbitrary claims that jwt.decode successfully accepts. Because the system improperly handles zero-length keys, validation checks fail to block maliciously crafted tokens.

This vulnerability carries a CVSS base score of 7.4 with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The high severity stems from the ability to completely compromise authentication guarantees over network vectors.

Who is affected by this vulnerability?

Applications utilizing HS256, HS384, or HS512 algorithms with python-jose up to version 3.5.0 are directly affected. Systems relying on dynamic JSON Web Key configurations where an oct JWK might accidentally resolve to an empty k parameter are at highest risk.

Technical details and references can be found in the official advisories from [[nvd.nist.gov|NIST NVD]], [[cve.org|CVE.org]], and [[vulncheck.com|VulnCheck]] [[https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key|advisories]].

How do I protect my system?

To secure your applications against CVE-2026-120459, you must ensure that your verification keys never resolve to empty values or zero-length secrets.

Review your implementation of HMAC verification and check the source code references in [[github.com|cryptography backend]] and [[github.com|native backend]] [[https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py|implementations]] to understand how keys are processed. You can also track discussion on [[github.com|issue 398]] [[https://github.com/mpdavis/python-jose/issues/398|on GitHub]].