CyberRota Analysis
AI-GeneratedPython-jose versions up to 3.5.0 are vulnerable due to improper validation of asymmetric keys during HMAC initialization, allowing attackers with access to the service's public key to forge valid HS256 tokens if algorithm restrictions are not enforced. This critical vulnerability poses a significant risk to applications relying on token-based authentication, as it can lead to unauthorized access and data breaches. Organizations using python-jose should prioritize immediate updates to mitigate this security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.