What’s Vulnerable › Vulnerabilities

CVE-2026-102272: PyJWT BOM Bypass

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-28 · updated 2026-10-06
• Weakness: CWE-347

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Affected products

• jpadilla pyjwt: 2.13.0

References

• https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947

Get alerted when CVE-2026-102272 or the next vulnerability affects your stack