GHSA-G3JJ-5CMM-3HXX fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

CVE-2026-107724

The fast-jwt library (version 6.2.4 ) contains a vulnerability where raw serialized public JWK or JWKS JSON can be incorrectly classified as an HMAC secret . The root cause is located in src/crypto.js within the performDetectPublicKeyAlgorithms function, which treats non-PEM strings as symmetric ...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

PYSEC-2026-4151 PyJWT accepts public JWK containers as HMAC secrets

Summary PyJWT 2.13.0 contains an incomplete defense against algorithm confusion when an application mixes symmetric and asymmetric algorithms in one verification path. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when it is wrapped in a JWKS object, nested in an array, or...

AZL-105227 CVE-2026-102273 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

DEBIAN-CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102273 PyJWT accepts public JWK containers as HMAC secrets

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

EUVD-2026-88541

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102273 PyJWT accepts public JWK containers as HMAC secrets

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102273

The PyJWT Python library (versions 2.13.0 through 2.14.0 ) contains a vulnerability in HMACAlgorithm.prepare_key . The flaw occurs because the HMAC key guard fails to recognize container representations, allowing public JWK containers to be accepted as HMAC secrets when an application supports bo...

CVE-2026-102273: Improper Verification of Cryptographic Signature

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...