What’s Vulnerable › Vulnerabilities

CVE-2026-102273: PyJWT accepts public JWK containers as HMAC secrets

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-28 · updated 2026-10-06
• Weakness: CWE-347

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Affected products

• jpadilla pyjwt: 2.13.0

References

• https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w

Get alerted when CVE-2026-102273 or the next vulnerability affects your stack