python-jose versions up to 3.5.0 contain an authentication by-pass that allows an attacker to forge JSON Web Tokens when the HMAC secret is an empty string. The flaw arises because the library accepts zero‑length HMAC secrets in HMACKey and CryptographyHMACKey, allowing HS256/HS384/HS512 verification to succeed on crafted tokens. This can lead to unauthorized access, privilege escalation, or other abuse of the application’s authentication system.

The vulnerability affects the Python‑Jose library, maintained by mpdavis, in all releases up to and including version 3.5.0. Any application that uses this library for token parsing and accepts JWTs signed with an empty key is at risk.

The CVSS score of 9.1 indicates a high severity flaw. Exploitation is possible by sending a JWT with an empty HMAC key that the application will accept. Because the EPSS score is not available, the likelihood of widespread exploitation cannot be precisely measured, and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely to target any service that uses python‑jose to verify tokens and has misconfigured or missing key validation, allowing forgery of tokens with arbitrary claims.