CVE-2026-102274

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

Summary

A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.from_jwk can raise a plain ValueError that isn't caught by PyJWKSet's per-key error-skipping logic.

Affected component / version

• Package: PyJWT (PyPI, ecosystem pip)
• Files: jwt/api_jwk.py (PyJWK.__init__, PyJWKSet.__init__), jwt/algorithms.py (RSAAlgorithm.from_jwk)
• Confirmed present in the master branch as of 2026-09-05 (commit 7144e4534c34810f4525dc4578a32addd8212cff, tag 2.13.0). Directly verified identical in tags 2.9.0, 2.10.0, 2.11.0, 2.12.0, 2.12.1, 2.13.0 -- the vulnerable call and the except PyJWTError guard are unchanged across all six releases. Not verified against any release prior to 2.9.0.

Details

PyJWKSet.__init__ (jwt/api_jwk.py:145-152) iterates each key in a JWK Set:

for key in keys:
    try:
        self.keys.append(PyJWK(key))
    except PyJWTError as error:
        if isinstance(error, MissingCryptographyError):
            raise error
        # skip unusable keys
        continue

PyJWK.__init__ (api_jwk.py:82) calls self.Algorithm.from_jwk(self._jwk_data) with no try/except of its own. For an RSA JWK, this dispatches to RSAAlgorithm.from_jwk (jwt/algorithms.py:539-586). When the JWK supplies d, e, n without the CRT parameters (p, q, dp, dq, qi), from_jwk calls cryptography's rsa_recover_prime_factors(public_numbers.n, d, public_numbers.e) (algorithms.py:572-574) to derive the key. If d is not the correct private exponent for that n/e pair, rsa_recover_prime_factors raises a plain ValueError.

ValueError is a built-in Python exception and is not a subclass of jwt.exceptions.PyJWTError (PyJWTError(Exception) is the root of PyJWT's own exception hierarchy). It is therefore not caught by PyJWKSet.__init__'s except PyJWTError, and propagates out of the constructor, aborting the for key in keys: loop before any subsequent key in the list is processed.

PyJWKSet.from_dict/from_json and PyJWK.from_dict/from_json are exported public API (jwt/__init__.py). PyJWKClient.get_jwk_set (jwt/jwks_client.py:158) feeds a fetched JWKS HTTP response directly into PyJWKSet.from_dict with no per-key pre-validation, so this is reachable through the documented PyJWKClient flow whenever the fetched JWKS contains a malformed key alongside valid ones.

Proof of concept

import jwt

good_jwk = {
    "kty": "RSA",
    "n": "<a valid base64url-encoded RSA modulus, e.g. from a real 2048-bit public key>",
    "e": "AQAB",
}

bad_jwk = {
    "kty": "RSA",
    "n": good_jwk["n"],
    "e": "AQAB",
    "d": "AAAAAA",  # not the true private exponent for n/e, no CRT params present
}

jwks_doc = {"keys": [bad_jwk, good_jwk]}

jwt.PyJWKSet.from_dict(jwks_doc)
# raises: ValueError: Unable to compute factors p and q from exponent d.
# (uncaught -- PyJWKSet.__init__ never returns, `good_jwk` is never added)

Impact

PyJWKSet.__init__ raises before completing, so no key in the JWK Set is added to the resulting set, including keys unrelated to the malformed entry. This requires the malformed key to already be present in a JWK Set the application parses (e.g. one entry in an aggregated/federated key set, or a key affected by transit corruption before signature verification of the JWKS transport itself). Applications that vet each key individually before adding it to a trusted set are not affected. The failure is an uncaught ValueError, not one of PyJWT's documented jwt.exceptions.* types, so exception handling written against PyJWT's documented contract (except jwt.exceptions.PyJWTError) will not catch it either.

Suggested remediation

Wrap the key-construction call in PyJWK.__init__ (api_jwk.py:82) so a ValueError is converted into InvalidKeyError (a PyJWTError subclass):

try:
    self.key =…

Summary

A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.from_jwk can raise a plain ValueError that isn't caught by PyJWKSet's per-key error-skipping logic.

Affected component / version

• Package: PyJWT (PyPI, ecosystem pip)
• Files: jwt/api_jwk.py (PyJWK.__init__, PyJWKSet.__init__), jwt/algorithms.py (RSAAlgorithm.from_jwk)
• Confirmed present in the master branch as of 2026-09-05 (commit 7144e4534c34810f4525dc4578a32addd8212cff, tag 2.13.0). Directly verified identical in tags 2.9.0, 2.10.0, 2.11.0, 2.12.0, 2.12.1, 2.13.0 -- the vulnerable call and the except PyJWTError guard are unchanged across all six releases. Not verified against any release prior to 2.9.0.

Details

PyJWKSet.__init__ (jwt/api_jwk.py:145-152) iterates each key in a JWK Set:

for key in keys:
    try:
        self.keys.append(PyJWK(key))
    except PyJWTError as error:
        if isinstance(error, MissingCryptographyError):
            raise error
        # skip unusable keys
        continue

PyJWK.__init__ (api_jwk.py:82) calls self.Algorithm.from_jwk(self._jwk_data) with no try/except of its own. For an RSA JWK, this dispatches to RSAAlgorithm.from_jwk (jwt/algorithms.py:539-586). When the JWK supplies d, e, n without the CRT parameters (p, q, dp, dq, qi), from_jwk calls cryptography's rsa_recover_prime_factors(public_numbers.n, d, public_numbers.e) (algorithms.py:572-574) to derive the key. If d is not the correct private exponent for that n/e pair, rsa_recover_prime_factors raises a plain ValueError.

ValueError is a built-in Python exception and is not a subclass of jwt.exceptions.PyJWTError (PyJWTError(Exception) is the root of PyJWT's own exception hierarchy). It is therefore not caught by PyJWKSet.__init__'s except PyJWTError, and propagates out of the constructor, aborting the for key in keys: loop before any subsequent key in the list is processed.

PyJWKSet.from_dict/from_json and PyJWK.from_dict/from_json are exported public API (jwt/__init__.py). PyJWKClient.get_jwk_set (jwt/jwks_client.py:158) feeds a fetched JWKS HTTP response directly into PyJWKSet.from_dict with no per-key pre-validation, so this is reachable through the documented PyJWKClient flow whenever the fetched JWKS contains a malformed key alongside valid ones.

Proof of concept

import jwt

good_jwk = {
    "kty": "RSA",
    "n": "<a valid base64url-encoded RSA modulus, e.g. from a real 2048-bit public key>",
    "e": "AQAB",
}

bad_jwk = {
    "kty": "RSA",
    "n": good_jwk["n"],
    "e": "AQAB",
    "d": "AAAAAA",  # not the true private exponent for n/e, no CRT params present
}

jwks_doc = {"keys": [bad_jwk, good_jwk]}

jwt.PyJWKSet.from_dict(jwks_doc)
# raises: ValueError: Unable to compute factors p and q from exponent d.
# (uncaught -- PyJWKSet.__init__ never returns, `good_jwk` is never added)

Impact

PyJWKSet.__init__ raises before completing, so no key in the JWK Set is added to the resulting set, including keys unrelated to the malformed entry. This requires the malformed key to already be present in a JWK Set the application parses (e.g. one entry in an aggregated/federated key set, or a key affected by transit corruption before signature verification of the JWKS transport itself). Applications that vet each key individually before adding it to a trusted set are not affected. The failure is an uncaught ValueError, not one of PyJWT's documented jwt.exceptions.* types, so exception handling written against PyJWT's documented contract (except jwt.exceptions.PyJWTError) will not catch it either.

Suggested remediation

Wrap the key-construction call in PyJWK.__init__ (api_jwk.py:82) so a ValueError is converted into InvalidKeyError (a PyJWTError subclass):

try:
    self.key =…

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.10.1.post4+tuxcare.

TuxCare rebuilt pyjwt to address 4 CVEs. Fixed in 2.8.0.post6+tuxcare.

This update for python-PyJWT fixes the following issues:

• CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
• CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
• CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
• CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
• CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
• CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
• CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
• CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).
• CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072).
• CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829).

This update for python-PyJWT fixes the following issues:

• CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
• CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
• CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
• CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
• CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
• CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
• CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
• CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).
• CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072).
• CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829).

This update for python-PyJWT fixes the following issues:

• CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
• CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
• CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
• CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
• CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
• CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
• CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
• CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).
• CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072).

This update for python-PyJWT fixes the following issues:

• CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
• CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
• CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
• CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
• CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
• CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
• CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
• CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).
• CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072).
• CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829).

This update for python-PyJWT fixes the following issues:

• CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
• CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
• CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
• CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
• CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
• CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
• CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
• CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).
• CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072).
• CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829).

Kingsley Olukanni discovered that PyJWT did not properly handle unknown key identifiers when retrieving signing keys. An attacker could possibly use this issue to amplify requests to the configured key endpoint, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917)

Ekalabya Ghosh discovered that PyJWT did not properly handle certain recursively nested JSON payloads. An attacker could possibly use this issue to cause an application to fail, resulting in a denial of service. (CVE-2026-101918)

Pedram Hayati discovered that PyJWT did not properly handle malformed RSA keys in a JSON Web Key Set. An attacker could possibly use this issue to cause authentication failures or a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102274)

It was discovered that PyJWT did not properly validate certain OKP private key components. An attacker could possibly use this issue to confuse the identity of public and private keys, and use a stolen sender-constrained token without the legitimate private key. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102275)