python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting
    DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key
    can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an
    incomplete fix for CVE-2024-33663. (CVE-2026-85394)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting     DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key     can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an     incomplete fix for CVE-2024-33663. (CVE-2026-85394)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472999	SCA: security update for python-jose (GHSA-3qf3-8w2g-rqmx)	Tenable Cloud Security	SCA Checks	Local	critical
472999	SCA: security update for python-jose (GHSA-3qf3-8w2g-rqmx)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
343059	Linux Distros Unpatched Vulnerability : CVE-2026-85394	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-85394

critical

Tenable Plugins

critical

critical

critical