PT-2025-41563 · Pypi+1 · Python-Jose+1

Javiermorales36 · Published 2025-10-10 · Updated 2025-10-10 · CVE-2025-61152

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions python-jose versions through 3.3.0

Description The software accepts JWT tokens with 'alg=none' without cryptographic signature verification. This allows a malicious actor to create forged tokens with arbitrary claims, potentially bypassing authentication checks and leading to privilege escalation or unauthorized access. The API endpoint is not specified. The vulnerable parameter is the JWT token itself. The vulnerable function is the token validation process.

Recommendations Versions prior to 3.3.1 should be updated.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-61152

Affected Products

Debian

Python-Jose

References · 13

• 🔥 https://github.com/javiermorales36/PoC-for-python-jose-alg-none-JWT-bypass-vulnerability/blob/main/CVE-2025-61152_Security_Advisory.md · Exploit
• https://ubuntu.com/security/CVE-2025-61152 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61152 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-61152 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61152 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61152 · Vendor Advisory
• https://github.com/mpdavis/python-jose/issues/391 · Note
• https://twitter.com/CVEnew/status/1976652824722227608 · Twitter Post
• https://pypi.org/project/python-jose · Note
• https://twitter.com/VulmonFeeds/status/1976678926937215477 · Twitter Post
• https://t.me/CVEtracker/34590 · Telegram Post