pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance

A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...