87,655 FastAPI fingerprints are not a python-jose exposure count
python-jose is a Python library used to implement JSON Object Signing and Encryption and JWT flows. It does not have a reliable public product fingerprint. A ZoomEye query for app="FastAPI" returned 87,655 matches on November 4, 2026, while http.header="X-Powered-By: Python" returned 228.
Neither query counts vulnerable python-jose installations. They count a framework and an optional header that may appear near a Python web service. The library, its version, and its key configuration sit below the HTTP response.
Observation
| Query | Matches |
|---|---|
app="FastAPI" |
87,655 |
http.header="X-Powered-By: Python" |
228 |
The FastAPI query completed at 2026-11-04T23:45:02Z and the header query at 2026-11-04T23:45:05Z. Both used page 1, page size 1, and sub_type=all. Both succeeded.
The FastAPI count is much larger than the Python header count. A framework can be fingerprinted through framework-specific response behavior while the generic Python header is absent or stripped. The comparison shows why a single application field is not a software inventory.
The vulnerability context
CVE-2026-120459 affects python-jose through 3.5.0. The public advisory says HMAC key wrappers accept zero-length secrets, allowing forged JWTs. That is a library and configuration problem. It cannot be detected by asking a FastAPI server for its banner.
An application may use Python without using python-jose. It may use FastAPI with another JWT library. It may use python-jose outside FastAPI entirely. The framework count is only a clue about the language and web stack.
Inventory deployed packages
Search Python manifests, lockfiles, container images, and virtual environments for python-jose. Record the resolved version and the package that depends on it. Check serverless bundles and notebooks because they may not appear in the main service inventory.
Trace the source of every HMAC key. Reject empty strings at startup and require a secret manager or a validated local secret. Add tests for both HMACKey and CryptographyHMACKey, and enforce issuer, audience, expiry, and algorithm checks in the verifier.
Use framework counts as a starting point
The FastAPI count can help a researcher describe the size of a Python web population. It cannot identify the dependency tree or the key configuration inside a service. The Python header count is even less reliable because applications and proxies often remove or rewrite it.
For remediation, rely on source manifests, runtime package inspection, and controlled token-forgery tests. Those checks identify the library and prove whether an empty key is accepted. A public count can prioritize outreach, but it cannot replace that evidence.
Top comments (0)