Cyber & AI intelligence
Wasteland.
Briefs indexed2403
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85394 2026-09-03

CVE-2026-85394: python-jose Algorithm Confusion via DER-Encoded Public Key as HMAC Secret

"A critical flaw in python-jose through version 3.5.0 can allow an attacker who holds a service's public key to forge HS256 JWTs that the library accepts as valid, but only where the application leaves the permitted…"

A critical flaw in python-jose through version 3.5.0 can allow an attacker who holds a service's public key to forge HS256 JWTs that the library accepts as valid, but only where the application leaves the permitted algorithm set unrestricted at verification time. Applications that pin the expected algorithm are not exposed by this path.

What Is It

python-jose fails to properly validate asymmetric keys during HMAC initialization. The library accepts DER-encoded public keys that lack PEM armor or SSH prefixes, meaning a key intended for asymmetric verification can be silently used as an HMAC shared secret. An attacker who possesses the service's public key, which is, by design, not secret, can sign a token with HS256 using that key material and have it pass verification, provided the application does not explicitly restrict the permitted algorithms.

This is a classic JWT algorithm-confusion pattern, and NVD explicitly notes it is an incomplete fix for CVE-2024-33663. The assigned weakness is CWE-347 (Improper Verification of Cryptographic Signature).

Why It Matters

CVSS v3.1 scores this 9.1 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The CVSS v4.0 secondary score is 9.3 (Critical). Attack vector is network, complexity is low, and no privileges or user interaction are required. Confidentiality and integrity impact are both High.

In practical terms, exploitation against an affected configuration means arbitrary token forgery: an attacker can mint tokens asserting any identity or claim set the application trusts. For services that use JWTs for authentication or authorization and do not constrain accepted algorithms, that amounts to an authentication bypass. The prerequisite, access to the service's public key, is a low bar, since public keys are routinely published via JWKS endpoints or embedded in client distributions.

There is no CISA KEV entry in the supplied source material, so active exploitation is not confirmed at this time.

What's Vulnerable

The referenced code paths are jose/backends/native.py and jose/utils.py.

Patch Status

The supplied NVD record lists no fixed version and no required remediation deadline. Status is "Received" as of 2026-09-03, meaning the scoring and affected-version data have not yet completed NVD analysis and may change. Until a patched release is confirmed, the practical mitigation implied by the advisory is to explicitly restrict accepted algorithms at verification time rather than allowing the library to infer them from the key.

Sources