{"id":"CVE-2026-85394","aliases":["CLSA-2026-1791441237","EUVD-2026-70671","GHSA-3qf3-8w2g-rqmx","GHSA-6c5p-j8vq-pqhj","PYSEC-2024-232","PYSEC-2026-4298","ROOT-APP-PYPI-CVE-2026-85394","UBUNTU-CVE-2026-85394"],"status":"published","title":"python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00222,"percentile":0.12899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327","CWE-347"],"published":"2024-04-25T00:00:00Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"TuxCare:PyPI","package":"python-jose","fixed_in":["3.3.0.post3+tuxcare"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"python-jose","fixed_in":["3.5.0+aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.0.post3+tuxcare"}]}],"versions":["3.3.0","3.3.0.post1+tuxcare","3.3.0.post2+tuxcare"]},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0"],"bundled":2},{"source":"osv","ecosystem":"Root:PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+dfsg-4"]}],"products":[{"vendor":"mpdavis","product":"python-jose"}],"references":[{"url":"https://github.com/mpdavis/python-jose/issues/414","tags":["issue-tracking","report","web"]},{"url":"https://github.com/mpdavis/python-jose","tags":["product","package","report"]},{"url":"https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.py","tags":["technical-description","article","web","report"]},{"url":"https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.py","tags":["technical-description","article","web","report"]},{"url":"https://github.com/advisories/GHSA-6c5p-j8vq-pqhj","tags":["related","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/python-jose-through-3.5.0-algorithm-confusion-via-der-encoded-public-key-as-hmac-secret","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85394","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3qf3-8w2g-rqmx","tags":["advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33663.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33663","tags":["advisory"]},{"url":"https://github.com/mpdavis/python-jose/issues/346","tags":["report","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85394.json","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml","tags":["web"]},{"url":"https://pypi.org/project/python-jose","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-85394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85394","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-85394","title":"python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T18:54:26.563Z","modified":"2026-09-14T13:50:51.862Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-70671","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T18:54:26Z","modified":"2026-09-14T13:50:51Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:28:20.757989Z"}],"ghsa":[{"id":"GHSA-3qf3-8w2g-rqmx","title":"python-jose algorithm confusion guard bypassed by DER-encoded public keys","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T21:31:15Z","modified":"2026-10-05T22:55:02Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-85394","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T19:17:31.257Z","modified":"2026-09-24T20:43:32.537Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"CVE-2024-33663","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-25T00:00:00Z","modified":"2026-10-28T02:30:33.200550083Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"CVE-2026-85394","title":"python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T18:54:26.563Z","modified":"2026-10-28T02:30:49.314185303Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"GHSA-3qf3-8w2g-rqmx","title":"python-jose algorithm confusion guard bypassed by DER-encoded public keys","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T21:31:15Z","modified":"2026-10-15T14:56:01.261338787Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"GHSA-6c5p-j8vq-pqhj","title":"python-jose algorithm confusion with OpenSSH ECDSA keys","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:30:35Z","modified":"2026-10-15T14:56:01.261338787Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"PYSEC-2026-4298","title":"python-jose algorithm confusion guard bypassed by DER-encoded public keys","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-10-15T10:22:43.820157Z","modified":"2026-10-15T14:56:01.261338787Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2026-85394","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T19:17:00Z","modified":"2026-09-16T11:43:10Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"CLSA-2026-1791441237","title":"TuxCare security update for python-jose (1 CVE)","description":"TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post3+tuxcare.","status":"published","published":"2026-10-08T06:33:57Z","modified":"2026-10-15T09:46:39.657265392Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"PYSEC-2024-232","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:15:09Z","modified":"2026-10-15T14:56:01.261338787Z","updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"ROOT-APP-PYPI-CVE-2026-85394","title":"CVE-2026-85394 in python-jose - Patched by Root","description":"Root has patched CVE-2026-85394 in the python-jose package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-14T07:44:07Z","modified":"2026-10-14T08:15:03.243219869Z","updated_at":"2026-11-02T15:53:28.259095Z"}]}}