CVE-2026-102266

EUVD-2026-88484

28.09.2026, 21:17

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.4 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 13.27%

Affected Products (NVD)

Vendor	Product	Version
pyjwt_project	pyjwt	2.13.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

pyjwt

bookworm	2.6.0-1+deb12u1 fixed
bookworm (security)	2.6.0-1+deb12u1 fixed
forky	2.15.1-1 fixed
sid	2.15.1-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

pyjwt

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	Fixed in 2.10.1-4ubuntu1.2 released
stonking	Fixed in 2.13.0-1ubuntu1 released
xenial	not-affected

Red Hat Enterprise Linux Releases

Red Hat Product

Release

fence-agents-aliyun

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-all

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-amt-ws

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-apc

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-apc-snmp

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-aws

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-azure-arm

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-bladecenter

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-brocade

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-cisco-mds

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-cisco-ucs

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-common

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-compute

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-drac5

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-eaton-snmp

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-emerson

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-eps

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-gce

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-heuristics-ping

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-hpblade

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ibm-powervs

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ibm-vpc

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ibmblade

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ifmib

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ilo-moonshot

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ilo-mp

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ilo-ssh

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ilo2

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-intelmodular

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ipdu

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-ipmilan

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-kdump

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-kubevirt

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-lpar

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-mpath

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-nutanix-ahv

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-openstack

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-redfish

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-rhevm

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-rsa

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-rsb

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-sbd

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-scsi

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-virsh

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-vmware-rest

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-vmware-soap

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-wti

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-agents-zvm

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virt

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virtd

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virtd-cpg

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virtd-libvirt

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virtd-multicast

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virtd-serial

RHEL 9

0:4.10.0-122.el9_9.1

fixed

fence-virtd-tcp

RHEL 9

0:4.10.0-122.el9_9.1

fixed

ha-cloud-support

RHEL 9

0:4.10.0-122.el9_9.1

fixed

Amazon Linux Releases

Amazon Package

Release

python3-jwt

Amazon Linux 2023

0:2.4.0-1.amzn2023.0.6

fixed

python3-jwt+crypto

Amazon Linux 2023

0:2.4.0-1.amzn2023.0.6

fixed

Azure Linux Releases

Azure Package

Release

python-jwt

Azure Linux 3.0

0:2.15.1-1.azl3

fixed

Known Exploits!

Common Weakness Enumeration

CWE-347 - Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.

Vulnerability Media Exposure

[GERMAN] Red Hat Ansible Automation Platform: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Code mit Benutzer- oder Anwendungsrechten auszuführen, gültige kryptografische Token zu fälschen, die Authentifizierung zu umgehen, erweiterte Rechte zu erlangen, Denial-of-Service-Zustände auszulösen sowie Daten zu manipulieren oder offenzulegen.
Published: 2026-10-21T22:00:00+00:00

References

https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c

https://github.com/jpadilla/pyjwt/releases/tag/2.14.0

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r