7.4
Élevée
CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards
Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| pyjwt 2.13 | 2.13.0 → < 2.14.0 | 2.14.0 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de pyjwt
Les 22 CVE de pyjwt →
CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards
6.5
Moyenne
CVE-2026-102265
PyJWT is a Python implementation of JSON Web Token standards
5.3
Moyenne
CVE-2026-102275
PyJWT is a Python implementation of JSON Web Token standards
6.5
Moyenne
CVE-2026-102274
PyJWT is a Python implementation of JSON Web Token standards
5.9
Moyenne