Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-102268: PyJWT before 2.14 can let attackers forge tokens
CVE-2026-102268 · published 3 days ago
Summary
Versions of PyJWT prior to 2.14 may treat a specially altered public‑key file as a simple secret key. When an application mixes HMAC and asymmetric signing methods, this can let someone who knows the public key create fake authentication tokens. Update PyJWT to version 2.14 or later to stop the problem.
What to do
- Update pyjwt to version 2.14.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | jpadilla | pyjwt | < 2.14.0 |
| pip | – | pyjwt |
<= 2.13.0 Fix: upgrade to 2.14.0
|
| Ubuntu:Pro:16.04:LTS | canonical | pyjwt | All versions |
| PyPI | – | pyjwt |
< 2.14.0 Fix: upgrade to 2.14.0
|
| Debian:12 | debian | pyjwt | All versions |
Original advisory text
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
References
- https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac0... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1022... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102268 Vendor Advisory
- https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 URL
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9 Vendor Advisory
- https://github.com/advisories/GHSA-ffc3-869f-jxw9 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-102268 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102268 Third Party Advisory
- https://github.com/jpadilla/pyjwt Product
- https://security-tracker.debian.org/tracker/CVE-2026-102268 Vendor Advisory
- https://pypi.org/project/pyjwt Product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published28 Sep 2026
Updated2 Oct 2026
First seen28 Sep 2026
Sources
CVE-2026-102268 · NVD
CVE-2026-102268 · MITRE
CVE-2026-102268 · OSV
GHSA-ffc3-869f-jxw9 · GHSA
UBUNTU-CVE-2026-102268 · OSV
GHSA-ffc3-869f-jxw9 · OSV
DEBIAN-CVE-2026-102268 · OSV
PYSEC-2026-4145 · OSV
Track software like this
Free during beta