Mpdavis Python-jose vulnerabilities

• mpdavis python-jose python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key CVE-2026-120459 9.1 CriticalNovember 2, 2026
• mpdavis python-jose python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret CVE-2026-85394 Fix available 9.3 CriticalApril 25, 2024