CVE-2026-102272

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Traduire en français

Produits concernés

• jpadilla pyjwt
• Pyjwt project pyjwt

Scores CVSS

Faiblesses (CWE)

• CWE-347

Références

• https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291 Patch
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 ProductRelease Notes
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947 ExploitMitigationVendor Advisory
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947 ExploitMitigationVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories