redhat/python-jose vulnerabilities

Latest redhat/python-jose CVEs

Newest publication first

1. CVE-2026-85394 python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

   Published 2026-09-03

   Critical·CVSS 9.3

   python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not exp...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.