CVE-2026-102271CWE-347

CVE-2026-102271

High · published September 29, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
7.2
In the wild
Unconfirmed
What it is

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.2th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-29T01:17Z
Affected products (1)
ProductVersionsFixed in
pyjwt_project/pyjwt≥ 2.4.0, < 2.14.02.14.0
References (4)
https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499 · [email protected]https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 · [email protected]https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773 · [email protected]https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 20:31Z
    PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
    cvelistv5