CVE-2026-85394

python-jose through 3.5.0 (CWE-347) incompletely validates asymmetric keys when they are used to initialize HMAC verification — an incomplete fix for CVE-2024-33663 that still accepts DER-encoded public keys lacking PEM armor or SSH prefixes. When a service verifies tokens with python-jose using an asymmetric public key and does not explicitly restrict the accepted algorithms, an attacker can submit a token claiming HS256, and the library will treat the public key as the HMAC secret. Because public keys are not secret, anyone who can obtain the service's public key can forge HS256 tokens with arbitrary claims that pass verification, producing an authentication/authorization bypass with high confidentiality and integrity impact (CVSS 4.0: 9.3, critical). Any Python application built on python-jose versions through 3.5.0 that verifies JWTs in this configuration is affected. No public proof-of-concept, KEV listing, or known exploitation exists; EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Update python-jose to a fixed release beyond 3.5.0 as soon as one is published (the advisory data does not specify a fixed version) and track the project's advisory. As an immediate mitigation, always pass an explicit algorithms allowlist (e.g., algorithms=["RS256"]) to token verification so HS256 is never accepted alongside asymmetric keys, and audit any code path that loads public keys as raw DER (for example from JWKs) for use in HMAC verification.