[neeraj1235476]

_decrypt_and_auth in jose/jwe.py handles the A128CBC-HS256, A192CBC-HS384 and A256CBC-HS512 encryptions by running the AES-CBC decrypt and PKCS7 unpad first, and only then comparing the tag from the token against the computed HMAC, with a plain !=. A JWE whose ciphertext has been modified therefore comes back as Invalid padding bytes. from the unpadder rather than as a tag rejection, and the two failure modes are distinguishable. RFC 7516 section 5.2 step 15 requires the tag to be validated and the input rejected without emitting any decrypted output, and section 11.5 asks for the comparison to be constant time.

Compute the HMAC tag and check it with hmac.compare_digest before calling decrypt, so forged input never reaches the cipher or the unpadder. GCM is left as is because the AEAD backend already authenticates during decryption. The added test tampers with one ciphertext byte for each CBC-HMAC enc and expects Invalid JWE Auth Tag; it fails on master and passes with this change.