Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-102266: PyJWT library may accept forged authentication tokens
CVE-2026-102266 · published 2 days ago
Summary
The Python PyJWT library used for creating and verifying authentication tokens could be tricked into accepting forged tokens, potentially letting attackers gain unauthorized access. This affects all common PyJWT packages such as jpadilla/pyjwt, pyjwt, canonical/pyjwt, debian/pyjwt, and pyjwt_project/pyjwt. Upgrade to the latest released version of the library, which includes the security fix.
What to do
- Update pyjwt to version 2.14.0.
- Update debian pyjwt to version 2.14.0-1.
- Update pyjwt to version 2.13.0+aikido.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | jpadilla | pyjwt | >= 2.13.0, < 2.14.0 |
| pip | – | pyjwt |
>= 2.13.0, < 2.14.0 Fix: upgrade to 2.14.0
|
| Ubuntu:Pro:16.04:LTS | canonical | pyjwt | All versions |
| Debian:12 | debian | pyjwt | All versions |
| – | pyjwt_project | pyjwt |
2.13.0 cpe:2.3:a:pyjwt_project:pyjwt:2.13.0:*:*:*:*:*:*:* |
| Debian:14 | debian | pyjwt |
< 2.14.0-1 Fix: upgrade to 2.14.0-1
|
| Root:PyPI | – | pyjwt |
< 2.13.0+aikido.1 Fix: upgrade to 2.13.0+aikido.1
|
Original advisory text
CVE-2026-102266 in pyjwt - Patched by Root
Root has patched CVE-2026-102266 in the pyjwt package for Root:PyPI. Multiple fixed versions available.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1022... Vendor Advisory
- https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934... Third Party Advisory
- https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 Third Party Advisory
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102266 Vendor Advisory
- https://github.com/advisories/GHSA-9j54-fg26-wv3r
- https://ubuntu.com/security/CVE-2026-102266 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102266 Third Party Advisory
- https://github.com/jpadilla/pyjwt Product
- https://security-tracker.debian.org/tracker/CVE-2026-102266 Vendor Advisory
- https://pypi.org/project/pyjwt Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen28 Sep 2026
Sources
CVE-2026-102266 · NVD
CVE-2026-102266 · MITRE
CVE-2026-102266 · OSV
GHSA-9j54-fg26-wv3r · GHSA
UBUNTU-CVE-2026-102266 · OSV
GHSA-9j54-fg26-wv3r · OSV
DEBIAN-CVE-2026-102266 · OSV
PYSEC-2026-4143 · OSV
Track software like this
Free during beta