CVE-2026-102272

The PyJWT library (versions 2.13.0 up to 2.14.0) contains a vulnerability in the HMACAlgorithm.prepare_key function within jwt/algorithms.py. The root cause is that the raw-JWK detector fails to normalize accepted Unicode byte-order marks (BOM) before performing JSON checks. When a public JWK is ...

CVE-2026-102272 PyJWT BOM Bypass

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...