CVE-2026-102271
highPyJWT is a Python implementation of JSON Web Token standards.
Vendor / product: Pyjwt Project — pyjwt
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
CVSS
7.4
7.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-09-28 21:17
Modified: 2026-10-06 18:36
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
pyjwt_project / pyjwt ≥2.4.0 <2.14.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
Patch / mitigation: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773
Patch / mitigation: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773
References
- https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499 security-advisories@github.com
- https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 security-advisories@github.com
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773 security-advisories@github.com
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗