GHSA-PXH4-856F-4H89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Summary HMACAlgorithm.fromjwk accepts a symmetric kty=oct JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient, the HMAC verifier computes HMACkey=b"",...

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Summary HMACAlgorithm.fromjwk accepts a symmetric kty=oct JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient, the HMAC verifier computes HMACkey=b"",...

PyJWT HMAC Algorithm Unauthorized Access

The vulnerability of the HMACAlgorithm.fromjwk method in PyJWT is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-102266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used t...

SUSE CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

DEBIAN-CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

AZL-105239 CVE-2026-102266 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

UBUNTU-CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266

The PyJWT library (Python implementation of JSON Web Token standards) is vulnerable in versions 2.13.0 through 2.14.0 due to a flaw in the HMACAlgorithm.from_jwk method. The PyJWK verification path fails to apply prepare_key validation when a trusted JWK Set contains an oct entry with an empty k ...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

EUVD-2026-88484

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

PT-2026-108344

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from jwk is affected because PyJWK verification path used the decoded key without applying prepare key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. ...

CVE-2026-102266: Improper Verification of Cryptographic Signature

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

PT-2026-102350

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The HMACAlgorithm.from jwk function is affected because the PyJWK verification path uses the decoded key without applying prepare key validation. This occurs when a trusted JSON Web Key JWK Set...