CVE-2024-33663

Aliases:GHSA-6c5p-j8vq-pqhjPYSEC-2024-232ECHO-04e0-8ccc-e285DEBIAN-CVE-2024-33663CVE-2026-85394UBUNTU-CVE-2026-85394
Advisory lineage Upstream: 0 Downstream: 5
Received
Published: 03 Sept 2026, 18:54
Last modified:14 Sept 2026, 13:50

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.3 CRITICAL
v4.0 (cve.org)
EPSS Score
0.31% LOW
0% probability -0.38%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

03 Sept 2026, 18:54
Published
Vulnerability first disclosed
14 Sept 2026, 13:50
Last Modified
Vulnerability information updated

Description

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • v3.1•HIGH•Score: 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.31%• Percentile: 24%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

  • CWE-347•Improper Verification of Cryptographic Signature

    The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Systems

  • debian•python-jose

    all

  • ubuntu•python-jose

    all | all

  • mpdavis•python-jose

    ≤ 3.5.0

  • PyPI•python-jose

    < 3.4.0

  • python-jose_project•python-jose

    ≤ 3.3.0

References (13)