CVE-2025-61152
MEDIUM EPSS 22.1%
Published Oct 10, 20258mo ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Published Oct 10, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago
Description
python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A malicious actor can craft a forged token with arbitrary claims (e.g., is_admin=true) and bypass authentication checks, leading to privilege escalation or unauthorized access in applications that rely on python-jose for token validation. This issue is exploitable unless developers explicitly reject 'alg=none' tokens, which is not enforced by the library. NOTE: all parties agree that the issue is not relevant because it only occurs in a "verify_signature": False situation.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
22.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-269 Improper Privilege Management Authorization
References 3
- github.com https://github.com/javiermorales36/PoC-for-python-jose-alg-none-JWT-bypass-vulnerability/blob/main/CVE-2025-61152_Security_Advisory.md
- github.com https://github.com/mpdavis/python-jose/issues/391
- pypi.org https://pypi.org/project/python-jose
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.