python-jose
https://github.com/mpdavis/python-jose
Python
A JOSE implementation in Python
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Python not yet supported2 Subscribers
Add a CodeTriage badge to python-jose
Help out
- Issues
- Check the signature hash in the python-rsa RSAKey.verify
- Treat a wrong-length unwrapped CEK like an unwrap failure in jwe.decrypt
- Check the JWE auth tag before decrypting CBC-HMAC ciphertext
- Algorithm validation is optional - potential signature verification bypass
- Dependencies/backends: Require cryptography
- Reject DER-encoded asymmetric keys as HMAC secrets (CVE-2026-85394)
- [Vuln] Uncaught OverflowError / TypeError in jwt.decode() time-claim validation
- [Vuln] JWE AES-CBC-HMAC decryption is a padding oracle — HMAC verified after CBC decrypt/unpad
- Security: Algorithm confusion via optional algorithms parameter (CWE-327)
- [Security] HIGH: RSA JWK parameter validation missing; MEDIUM: SHA-1 in RSA_OAEP; algorithms=None bypass
- Docs
- Python not yet supported