Allowing a JSON Web Token (JWT) library to accept an empty HMAC secret can undermine the entire authentication process. In python-jose through version 3.5.0, both HMACKey and CryptographyHMACKey accept zero-length secrets, as detailed in the public advisory for CVE-2026-120459. The official CVE record, maintained by the CVE Program and assigned by VulnCheck, labels this as an "Authentication Bypass via Empty HMAC Key" and credits Gavin Blacklock for identifying the issue. If an application or library path creates an HMAC key from an empty value, an attacker can generate a JWT signed with that empty key and pass verification without knowing any real secret. The vulnerability affects python-jose versions 0 through 3.5.0.
Understanding the Security Flaw
JWT libraries usually separate algorithm selection, key loading, signing, and verification. The token header lists an algorithm, but the application decides which keys and algorithms to trust. The key wrapper turns configuration or bytes into a signing object. If the wrapper allows an empty secret, the application might use a key that provides no real security. This vulnerability does not add a new signing algorithm or require knowledge of a valid secret; it takes advantage of the acceptance of an empty key. The CVE record notes that HS256, HS384, and HS512 verification paths are affected, including cases where an octet JWK with an empty k parameter is used as the verification key. The technical failure is an input-validation problem in the HMAC key wrappers, not a flaw in HMAC itself.
Empty values can reach production through unset environment variables or secrets loaded before a vault is available. Default test values can also introduce this risk. If the verifier uses an empty key as the trust anchor, any token signed with that empty key will pass the signature check. The CVE record points out that exploitation depends on an application path supplying an empty secret as the verification key, so not every deployment of python-jose is automatically at risk. The vulnerability shows that a JWT signature check is only as strong as the key material given to the verifier. Anyone who knows the HMAC key can produce a valid MAC calculation, so accepting a zero-length key removes the intended secret-based authentication boundary.
The CVE-2026-120459 record assigns a severity score of 9.1 (Critical) under CVSS v4.0 and 7.4 (High) under CVSS v3.1. The CVSS v4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, which means network reachability, no required privileges or user interaction, and high confidentiality and integrity impact, with a required attack precondition. The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting higher attack complexity and high confidentiality and integrity impact without availability impact. These scores measure the potential impact of a vulnerable deployment. The affected product range is versions 0 through 3.5.0, and the CVE entry does not list a fixed version.
How to Identify and Mitigate the Risk
To protect authentication workflows, check your software manifests, container images, and Python environments for the python-jose dependency. It might appear directly or as a transitive dependency of another authentication package, notebook environment, or internal service. Record the resolved version and the package that brought it in. Trace the configuration supplying the HMAC secret by reviewing environment variable reads, secret manager calls, and default values. Look for code paths that use an empty string when a value is missing. Raising an exception at startup is safer than letting the application sign tokens with a zero-length key.
JWT verifiers should enforce an algorithm allowlist, issuer, audience, expiry, and token type. These checks help reduce the impact of a key construction error, but they do not replace secure key handling. Even if a forged token passes signature verification, it must still pass application-level authorization checks. The CVE record notes that the described attack requires the verifier to resolve its trusted HMAC key to empty, which is a prerequisite captured in the CVSS v4.0 attack vector through the AT:P component.
Testing and Remediation Steps
Create a test that passes an empty key to your application's token verification path. The request should fail before any claims are accepted. Repeat the test with a known non-empty test key and a token signed by a different key to confirm correct behavior. If your application uses both HMACKey and CryptographyHMACKey directly, check both code paths. Add a startup check that rejects missing secrets and logs a non-sensitive configuration error, but never log the secret or a token itself.
If you find that an affected service may have used an empty key, rotate all token-signing material and invalidate active tokens. Review authentication logs for tokens that were accepted but did not match the expected issuer or audience, and search for unusual token lifetimes or claims that do not fit your application schema. While a patch will address the library's behavior, applications must also make sure that absent configuration values are never treated as valid credentials.
The vulnerability is formally recorded by the CVE Program, with VulnCheck as the CNA and Gavin Blacklock credited as the finder. The CVE entry does not mention a government enforcement action, regulatory fine, court proceeding, software-recall order, or mandatory remediation deadline. No independent evidence in the authoritative material establishes a confirmed exploitation campaign, affected customer count, breach, or production incident tied to this CVE. The current status is that the vulnerability is officially recorded with critical/high severity ratings, while deployment-specific exposure and exploitation depend on configuration and must be checked from manifests and runtime key-loading behavior. For more details, see the official CVE record, the CVE-2026-120459 GitHub advisory, the OSV record, and the python-jose project.
