cve-2026-102268-poc

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass Exploitability analysis result: the root cause is confirmed and end-to-end exploitation is reproducible. A whitespace-mutated PEM public key bypasses PyJWT's ispemformat guard and is accepted as a valid HMAC secret, enabling full HS256 token...

OESA-2026-4387 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

OESA-2026-4386 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

OESA-2026-4385 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

OESA-2026-4384 python-jwt security update

setup.py test %endif Security Fixes: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an...

TencentOS Server 4: python-jwt (TSSA-2026:1087)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1087 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PyJWT HMAC Algorithm Bypass

The vulnerability of the HMACAlgorithm.preparekey function in the jwt/algorithms.py library of PyJWT is related to errors in cryptographic signature verification. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

PyJWT HMAC Algorithm Use-After-Free

The vulnerability of the HMACAlgorithm.preparekey function in the PyJWT library is related to errors in the verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms and gain unauthorized access to protected informati...

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

SummaryHMACAlgorithm.preparekey blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for -----BEGIN and for an ssh- prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is used as an HMAC secret.An...

PyJWT BOM Bypass

Affected Package- Package: PyJWT pyjwt on PyPI- Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt=gmail=1781794518474000=E- Affected version: 2.13.0- Vulnerability class: Algorithm confusion / patch bypass--- Root CausePyJWT 2.13.0 introduced a guard in...

PYSEC-2026-4150 PyJWT BOM Bypass

Affected Package - Package: PyJWT pyjwt on PyPI - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- Root Cause PyJWT 2.13.0 introduced a guard i...

PYSEC-2026-4145 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...

Linux Distros Unpatched Vulnerability : CVE-2026-102271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard...

Linux Distros Unpatched Vulnerability : CVE-2026-102272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JW...

SUSE CVE-2026-102271

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and...

SUSE CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

SUSE CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

GHSA-FFC3-869F-JXW9 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...

GHSA-P4G4-X82P-Q773 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Summary HMACAlgorithm.preparekey blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for -----BEGIN and for an ssh- prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is used as an HMAC secret. An...

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Summary HMACAlgorithm.preparekey blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for -----BEGIN and for an ssh- prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is used as an HMAC secret. An...