Summary
YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forge authentication tokens. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-102266)
Rohan Das discovered that PyJWT incorrectly handled redirects when fetching
key sets. A remote attacker could possibly use this issue to cause PyJWT
to disclose sensitive information. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS. (CVE-2026-102267)
It was discovered that PyJWT incorrectly recognized certain PEM
representations. An attacker who knew the public key could possibly use
this issue to forge authentication tokens. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu
26.04 LTS. (CVE-2026-102268)
Nuno Lopes discovered that PyJWT incorrectly handled DER public keys when
performing HMAC verification. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102271)
It was discovered that PyJWT did not properly handle certain JWK keys
prefixed with a byte-order mark. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102272)
Charles Vosburgh discovered that PyJWT incorrectly handled certain JWK
containers when performing HMAC verification. An attacker who knew the
public key could possibly use this issue to forge authentication tokens.
(CVE-2026-102273)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pyjwt | 2.3.0-1ubuntu0.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | pyjwt | 2.7.0-1ubuntu0.3 |
| Ubuntu · 26.04 LTS 26.04:LTS | pyjwt | 2.10.1-4ubuntu1.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pyjwt | 1.3.0-1ubuntu0.1+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | pyjwt | 1.7.1-2ubuntu2.1+esm3 |
Vulnerabilities 6
-
Critical 9.1CVE-2026-102268 Public exploit
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…
-
High 7.4
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…
-
High 7.4
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…
-
High 7.4
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …
-
High 7.4
PyJWT BOM Bypass
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…
-
High 7.4
PyJWT accepts public JWK containers as HMAC secrets
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an app…
References
-
report
https://ubuntu.com/security/CVE-2026-102266
-
report
https://ubuntu.com/security/CVE-2026-102267
-
report
https://ubuntu.com/security/CVE-2026-102268
-
report
https://ubuntu.com/security/CVE-2026-102271
-
report
https://ubuntu.com/security/CVE-2026-102272
-
report
https://ubuntu.com/security/CVE-2026-102273