python-jose through version 3.5.0 contains a vulnerability where asymmetric keys are not properly validated during HMAC initialization. The library accepts DER-encoded public keys that lack PEM armor or SSH prefixes, enabling algorithm confusion attacks. An attacker who possesses the service's public key can forge HS256 JWT tokens that pass verification when algorithms are not explicitly restricted. This represents an incomplete fix for the previously disclosed CVE-2024-33663. The vulnerability affects JWT-based authentication systems relying on python-jose without strict algorithm restrictions. Exploitation requires the attacker to have access to the service's public key, which is often publicly available. The issue stems from insufficient input validation in the native.py and utils.py backend modules of the library.
