CVE-2026-102275

The PyJWT library (versions 2.1.0 through 2.15.0 ) contains a vulnerability in the OKPAlgorithm.from_jwk function within jwt/algorithms.py. The root cause is that the private-JWK import path fails to compare the public key derived from d with x , allowing an OKP private JWK to supply non-correspo...

CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...

EUVD-2026-88547

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...