Description

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-03T19:17:31.257Z",
  "pubdate": "2026-09-03T19:17:31.257Z",
  "executiveSummary": "The python-jose library, through version 3.5.0, contains a critical cryptographic vulnerability related to insufficient validation of asymmetric public keys during HMAC initialization.\nThis flaw allows unauthorized actors who possess the service's public key to forge HS256 tokens that are erroneously accepted as valid by the library.\nThe vulnerability stems from an incomplete mitigation for CVE-2024-33663, specifically failing to enforce strict formatting requirements for DER-encoded public keys.\nBy neglecting to validate the presence of PEM armor or standard SSH prefixes, the library misinterprets raw DER-encoded public keys as legitimate HMAC secrets.\nThe risk implication is significant: attackers can achieve complete authentication bypass by creating arbitrary tokens signed with a symmetric key derived from the service's own public key.\nThis exploit does not require prior authentication and can be executed remotely if the application fails to explicitly restrict allowed algorithms to non-HMAC types.\nThe impact includes full account takeover, unauthorized access to protected resources, and a complete breakdown of trust in the JWT validation process.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of key material during the initialization of the HMAC verification process in python-jose. When the library is tasked with verifying a JSON Web Token (JWT), it must discern between asymmetric (e.g., RS256, ES256) and symmetric (e.g., HS256) signature algorithms.\nIn a secure implementation, an HMAC verifier should only accept symmetric keys. However, due to the failure to properly validate the input structure of the key, the library accepts DER-encoded public keys—even when they lack the expected PEM headers or SSH-specific prefixes—and treats the binary data of the public key as a secret symmetric HMAC key.\nThe attack flow proceeds as follows: First, an attacker obtains the target service's public key (e.g., via a public JWKS endpoint). Second, the attacker constructs a malicious JWT using the HS256 algorithm. Third, the attacker sets the 'key' material for the HS256 signature to the raw DER-encoded bytes of the service's public key.\nWhen the victim application receives this token, the vulnerable python-jose library initializes the HMAC verification process. Because the library fails to verify the key format, it uses the service's public key bytes as the HMAC secret key. Consequently, the signature validation passes because the token was signed with the exact same bytes that the library is using for the HMAC verification.\nThis behavior represents an incomplete remediation of CVE-2024-33663. The library's logic assumes that if a key is provided for verification, it is an appropriate key for the algorithm specified in the JWT header. By failing to validate that the key material is strictly compliant with expected format standards (PEM/SSH) or by failing to enforce algorithm-key type matching, the library allows for the forging of HS256 tokens using asymmetric public keys as the underlying HMAC secret.\nThe exploitation does not require the attacker to compromise the actual private key of the server. Instead, it leverages the asymmetry of the public key infrastructure against the logic of the symmetric HMAC validator. The post-exploitation impact is a total bypass of the integrity and authenticity checks of the JWT, allowing an attacker to impersonate any user or service identity recognized by the application."
}