Homepage

Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package python3.12-pyjwt  (opens in a new tab)

Threat Intelligence

EPSS
0.18% (7th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PYTHON312PYJWT-20282070
  • published30 Sept 2026
  • disclosed28 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 28 Sep 2026

NewCVE-2026-102273  (opens in a new tab)
CWE-347  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.12-pyjwt package and not the python3.12-pyjwt package as distributed by RHEL.

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.