CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

CVE-2026-102268

The PyJWT library (versions prior to 2.14.0 ) contains a vulnerability in jwt/utils.py where the is_pem_format function fails to recognize certain PEM representations accepted by the cryptography loader. This occurs when applications mixing HMAC and asymmetric algorithms provide mutated public-ke...

EUVD-2026-88534

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

CVE-2026-102267

The PyJWT library (versions prior to 2.14.0 ) is vulnerable in the PyJWKClient component because it fails to revalidate redirect destinations against the JWKS trust boundary . An attacker who can influence a configured trusted JWKS endpoint's response can trigger a redirect, causing PyJWKClient t...

CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

EUVD-2026-88484

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

CVE-2026-102266

The PyJWT library (Python implementation of JSON Web Token standards) is vulnerable in versions 2.13.0 through 2.14.0 due to a flaw in the HMACAlgorithm.from_jwk method. The PyJWK verification path fails to apply prepare_key validation when a trusted JWK Set contains an oct entry with an empty k ...

CVE-2026-101918 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918

The PyJWT Python library (versions 2.0.0a1 through 2.15.0 ) is vulnerable to an unhandled RecursionError in the PyJWKClient.get_signing_key_from_jwt function. This occurs because the payload parser catches ValueError but fails to handle RecursionError when processing an attacker-controlled recurs...