cve-2026-102268-poc

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass Exploitability analysis result: the root cause is confirmed and end-to-end exploitation is reproducible. A whitespace-mutated PEM public key bypasses PyJWT's ispemformat guard and is accepted as a valid HMAC secret, enabling full HS256 token...

ROOT-APP-PYPI-CVE-2026-48522 CVE-2026-48522 in PyJWT - Patched by Root

Root has patched CVE-2026-48522 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-PXH4-856F-4H89 GHSA-pxh4-856f-4h89 in PyJWT - Patched by Root

Root has patched GHSA-pxh4-856f-4h89 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-32597 CVE-2026-32597 in PyJWT - Patched by Root

Root has patched CVE-2026-32597 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48526 CVE-2026-48526 in pyjwt - Patched by Root

Root has patched CVE-2026-48526 in the pyjwt package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48524 CVE-2026-48524 in PyJWT - Patched by Root

Root has patched CVE-2026-48524 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

RLSA-2026:98612 Critical: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance...

RLSA-2026:98503 Critical: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance...

fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

ROOT-APP-PYPI-CVE-2026-102268 CVE-2026-102268 in pyjwt - Patched by Root

Root has patched CVE-2026-102268 in the pyjwt package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-102267 CVE-2026-102267 in pyjwt - Patched by Root

Root has patched CVE-2026-102267 in the pyjwt package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-102271 CVE-2026-102271 in pyjwt - Patched by Root

Root has patched CVE-2026-102271 in the pyjwt package for Root:PyPI. Multiple fixed versions available...

CVE-2018-0114-PoC

CVE-2018-0114 PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Example $ python3 script.py Making keys... 'alg': 'RS256', 'jwk': 'kty': 'RSA', 'kid': '[email protected]', 'use':...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: PyJWT: Authentication bypass via improper public key validation

A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...

pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets

A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens JWTs. When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key JWK container...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...