Is CVE-2026-120459 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120459?

CVE-2026-120459 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-120459

Description

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.