Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Tag

#JWT

1 articles

Deep Dive

python-jose JWT Forgery With an Empty HMAC Key (CVE-2026-120459)

python-jose through 3.5.0 accepts an empty HMAC secret, so a forged JWT verifies when the application's key resolves to empty; no fixed release.

Ostorlab Team
Nov 09, 2026