Review
mpdavis
CVE published 2026-09-03
CVE-2024-33663
The python-jose library through version 3.5.0 improperly validates asymmetric keys in HMAC initialization, allowing DER-encoded public keys without PEM armor or SSH prefixes. This vulnerability enables attackers with the service's public key to forge HS256 tokens that pass verification if algorithms are not explicitly restricted. Affected deployments should verify their configurations and consider updatin [truncated]