Confirmation: CVE-2024-33663 HMAC key-confusion reproduced on 3.3.0 vs 3.4.0 (no action needed)

[plotarmordev]

Independent confirmation of CVE-2024-33663 (GHSA-6c5p-j8vq-pqhj) via version-differential four-gate:

• Pinned wheels python-jose 3.3.0 vs 3.4.0, same harness, only the pinned package differs.
• Attacker: HS256 token hand-built with secret = the OpenSSH ECDSA public-key string (publicly known).
• 3.3.0: jose.jwt.decode(tok, ssh_str) ACCEPTS (claims returned).
• 3.4.0: JWKError "The specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret."
• ES256 legit + real-secret HS256 pass on BOTH sides.
  No action needed — 3.4.0 patch backport confirmed present. Filed as independent capability evidence.