python-jose CVE-2026-85394

Exploitation requires the attacker to possess the service's asymmetric (RSA/EC) public key - normally obtainable since public keys are not secret - and requires the verifying application to call python-jose's decode/verify without explicitly restricting the allowed algorithms (i.e., HS256 is implicitly accepted alongside the asymmetric key). The forged secret must be the DER-encoded form of the public key lacking PEM armor or SSH prefixes, which is precisely what the incomplete fix still accepts. The primary limiting factor is algorithm pinning: applications that explicitly whitelist only asymmetric algorithms are not exploitable. No authentication or user interaction is required against a vulnerable configuration.

The CVSS 4.0 base of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) reflects a network-reachable, unauthenticated integrity/confidentiality break with no availability impact, which is consistent with token forgery leading to authentication bypass and impersonation. Real-world risk is genuinely high but conditional: it requires that the target application (1) exposes or leaks its asymmetric public key - usually trivial, as public keys are meant to be shared - and (2) does not explicitly restrict verification algorithms, a common but not universal misconfiguration. No EPSS score, KEV listing, or public PoC was provided, so there is no evidence of active exploitation; the severity is driven by impact and the low barrier of the technique rather than confirmed in-the-wild use. Any operator running python-jose in a token-verification path where algorithms are unpinned should treat this as urgent and prioritize it well above its lack of KEV status would suggest, since exploitation is deterministic once the two conditions hold. The absence of a confirmed patched release for this specific incomplete-fix CVE increases urgency further.

An attacker obtains the service's RSA/EC public key (from a JWKS endpoint, TLS certificate, or published documentation), DER-encodes it, and uses it as the HMAC secret to sign a JWT with alg set to HS256 and a payload granting elevated privileges (e.g., admin role or another user's subject). If the application verifies tokens without pinning algorithms, python-jose accepts the DER public key as an HMAC key and the forged token passes verification, yielding authentication bypass and impersonation. No public PoC was provided, but the technique is deterministic and well-understood for this vulnerability class.