pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets

🗓️ 21 Oct 2026 13:55:34Reported by RedHatType

redhat🔗 access.redhat.com👁 6 Views

Authentication bypass in PyJWT via acceptance of DER public keys as HMAC secrets.

Reporter	Title	Published	Views	Family All 229
BDU FSTEC	PyJWT HMAC Algorithm Use-After-Free	2 Oct 202600:00	–	bdu_fstec
CBLMariner	CVE-2026-102271 affecting package python-jwt for versions less than 2.15.1-1	6 Oct 202618:59	–	cbl_mariner
Chainguard	CVE-2026-102271 vulnerabilities	30 Sep 202620:54	–	cgr
Circl	CVE-2026-102271	11 Sep 202613:37	–	circl
CVE	CVE-2026-102271	28 Sep 202620:31	–	cve
Cvelist	CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard	28 Sep 202620:31	–	cvelist
Debian CVE	CVE-2026-102271	28 Sep 202620:31	–	debiancve
EUVD	EUVD-2026-88539	28 Sep 202620:31	–	euvd
Github Security Blog	PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard	29 Sep 202623:14	–	github
Mend	CVE-2026-102271	28 Sep 202620:31	–	mend

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	noarch	python3.12-pyjwt	2.14.0-1.el9ap	python3.12-pyjwt-2.14.0-1.el9ap.noarch.rpm
Red Hat Enterprise Linux	9	noarch	python3.12-pyjwt+crypto	2.14.0-1.el9ap	python3.12-pyjwt+crypto-2.14.0-1.el9ap.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-102271
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
github	www.github.com/jpadilla/pyjwt/releases/tag/2.14.0
github	www.github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-102271
cve	www.cve.org/CVERecord

23 Oct 2026 10:53Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.4

EPSS0.0018

SSVC

PyJWT authentication bypass HMAC DER public keys remote attack