CVE-2026-85394: Improper Verification of Cryptographic Signature in mpdavis python-jose

The vulnerability in python-jose (up to version 3.5.0) involves improper verification of cryptographic signatures due to acceptance of DER-encoded public keys lacking expected PEM or SSH formatting during HMAC initialization. This flaw enables an attacker who possesses the service's public key to forge HS256 tokens that can bypass signature verification when the application does not explicitly restrict accepted algorithms. This vulnerability is an incomplete remediation of CVE-2024-33663 and carries a CVSS 4.0 base score of 9.3, indicating critical severity.

An attacker with access to the service's public key can forge HS256 tokens that will be accepted as valid by the vulnerable python-jose library, potentially allowing unauthorized access or privilege escalation in applications relying on this token verification. The vulnerability affects the cryptographic trust model by undermining signature validation, which can lead to token forgery and bypass of authentication or authorization controls.

No explicit patch or fix link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, applications should explicitly restrict accepted algorithms to prevent acceptance of forged tokens. Monitoring vendor advisories for an official fix is recommended.