← Vulnerability feed

Vulnerability record · CVE-2026-102272 · published 28 September 2026

CVE-2026-102272: Pyjwt project pyjwt improper verification of cryptographic signature vulnerability

Pyjwt Project · Pyjwt

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

7.4 CVSS 3.1 High EPSS 0.18% · top 92.9% CWE-347 · Improper verification of cryptographic signature
7.4CVSS 3.1 base score
0.18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
6 Oct 2026Last modified by NVD

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291 Patch
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 ProductRelease Notes
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947 ExploitMitigationVendor Advisory
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947 ExploitMitigationVendor Advisory

Track CVE-2026-102272 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-102266Pyjwt project pyjwt improper verification of cryptographic signature vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification…EPSS 0.18%9.1CVE-2026-102267Pyjwt project pyjwt information exposure vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not re…EPSS 0.16%9.1CVE-2026-102268Pyjwt project pyjwt improper verification of cryptographic signature vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does n…EPSS 0.20%8.2CVE-2026-102275Pyjwt project pyjwt insufficient verification of data authenticity vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected b…EPSS 0.14%7.5CVE-2026-102274Pyjwt project pyjwt vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malfor…EPSS 0.39%7.5CVE-2026-101918Pyjwt project pyjwt vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected becau…EPSS 0.36%7.5CVE-2026-101917Pyjwt project pyjwt allocation without limits vulnerabilityPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses …EPSS 0.42%7.5CVE-2026-32597Pyjwt project pyjwt insufficient verification of data authenticity vulnerabilityPyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2026-102272), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.