python-jose
https://github.com/mpdavis/python-jose
Python
A JOSE implementation in Python
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Python not yet supported2 Subscribers
Add a CodeTriage badge to python-jose
Help out
- Issues
- Reject DER-encoded asymmetric keys as HMAC secrets (CVE-2026-85394)
- [Vuln] Uncaught OverflowError / TypeError in jwt.decode() time-claim validation
- [Vuln] JWE AES-CBC-HMAC decryption is a padding oracle — HMAC verified after CBC decrypt/unpad
- Security: Algorithm confusion via optional algorithms parameter (CWE-327)
- [Security] HIGH: RSA JWK parameter validation missing; MEDIUM: SHA-1 in RSA_OAEP; algorithms=None bypass
- Confirmation: CVE-2024-33663 HMAC key-confusion reproduced on 3.3.0 vs 3.4.0 (no action needed)
- Fix RSA1_5 padding oracle: length-check the unwrapped CEK
- Algorithm-confusion guard bypassed by DER-encoded public keys (incomplete CVE-2024-33663 fix)
- [Security] python-jose ignores the JWS `crit` header (RFC 7515)
- fix: reject tokens missing 'aud' claim when audience is expected
- Docs
- Python not yet supported