CVE-2026-120459

Published 2 November 2026 · tracked since 2 November 2026

Description

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with e

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-120428 MEDIUM 6.1
• CVE-2026-120318 HIGH 7.2
• CVE-2026-109083
• CVE-2026-110535
• CVE-2026-111959
• CVE-2026-113511
• CVE-2026-113687
• CVE-2026-114364
• CVE-2026-102802
• CVE-2026-103419

→ Open the live CVE board · all tools