Upwind Security MDR@UpwindMDR
Disclosure
🚨 Critical - python-jose JWT Algorithm Confusion via DER Key Acceptance (CVE-2026-85394) python-jose <=3.5.0 mishandles asymmetric keys during HMAC initialization, accepting DER-encoded public keys without PEM armor or an SSH prefix. If JWT verification does not strictly restrict algorithms, an attacker with the service’s public key can forge HS256 tokens that validate and bypass authentication. This is an incomplete fix for CVE-2024-33663. 👉 Affected: python-jose <= 3.5.0
Post summary
The alert announces a critical vulnerability in python‑jose that accepts DER public keys, enabling forged JWTs; it offers technical details but no PoC, exploit code, patch, or evidence of active exploitation.
0001083
301 followersView on X