Critical Vulnerability in python-jose Package: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- python-jose (pypi)
- Affected versions
- >= 3.2.0, <= 3.2.0 or >= 3.1.0, <= 3.1.0 or >= 3.0.1, <= 3.0.1 or >= 3.0.0, <= 3.0.0 or >= 2.0.2, <= 2.0.2 or >= 2.0.1, <= 2.0.1 or >= 1.4.0, <= 1.4.0 or >= 1.3.2, <= 1.3.2 or >= 1.3.1, <= 1.3.1 or >= 1.3.0, <= 1.3.0 or >= 1.2.0, <= 1.2.0 or >= 1.1.0, <= 1.1.0 or >= 1.0.0, <= 1.0.0 or >= 0.7.0, <= 0.7.0 or >= 0.6.2, <= 0.6.2 or >= 0.6.1, <= 0.6.1 or >= 0.6.0, <= 0.6.0 or >= 0.5.6, <= 0.5.6 or >= 0.5.5, <= 0.5.5 or >= v0.5.4, <= v0.5.4 or >= 0.5.3, <= 0.5.3 or >= v0.5.2, <= v0.5.2 or >= v0.5.1, <= v0.5.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.5, <= v0.1.5
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the python-jose package. Users of versions up to 3.5.0 are reportedly at risk.
What happened
The python-jose package through version 3.5.0 appears to fail in properly validating asymmetric keys during HMAC initialization. This vulnerability allows attackers to forge HS256 tokens that pass verification. This issue is an incomplete fix for CVE-2024-33663. The vulnerability is currently under investigation and no exploits in the wild have been confirmed.
Affected versions span from 3.2.0 down to 0.1.5 inclusive. The vulnerability has been assigned CVE-2026-85394 with a CVSS score of 9.1 indicating critical severity. Users are advised to assess their exposure by checking their python-jose package versions against the affected range.
What to do about it
- Upgrade to a version of python-jose that properly validates asymmetric keys and restricts algorithms explicitly.
- Review your project dependencies to identify and update any instances of python-jose within the affected version range.
- If using python-jose in a production environment, perform thorough testing post-upgrade to ensure no regressions.
- Monitor the NVD and OSV sources for updates on patched versions and further details on the vulnerability.
How 0Day would have caught this
python-jose is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using python-jose package versions from 3.2.0 down to 0.1.5 inclusive.
What should I do right now?
Immediately upgrade to a version of python-jose that properly validates asymmetric keys and restricts algorithms explicitly. Review and update your project dependencies.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates.