by Kastro
Paper/Archive/CVE-2026-85394

CVE-2026-85394

mpdavis python-jose — python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 12.9.129 × 202.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Affected

ProductAffectedFixed inSource
python-jose≤ 3.5.0–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/mpdavis/python-jose/issues/414refgithub.com/mpdavis/python-josewriteupgithub.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.pywriteupgithub.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.pyrefgithub.com/advisories/GHSA-6c5p-j8vq-pqhjwriteupvulncheck.com/advisories/python-jose-through-3.5.0-algorithm-confusion-via-der-encoded-public-key-as-hmac-secret