{"id":"CVE-2026-102272","aliases":["ALSA-2026:94500","ALSA-2026:94501","AZL-105224","BELL-CVE-2026-102272","CLSA-2026-1793606235","CLSA-2026-1793698392","CLSA-2026-1793869522","DEBIAN-CVE-2026-102272","EUVD-2026-88540","GHSA-r6x4-923q-g947","PYSEC-2026-4150","RLSA-2026:94500","RLSA-2026:94501","ROOT-APP-PYPI-CVE-2026-102272","UBUNTU-CVE-2026-102272","USN-8916-1","USN-8916-2","openSUSE-SU-2026:11994-1"],"status":"published","title":"PyJWT BOM Bypass","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00216,"percentile":0.12241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-09-28T20:36:31Z","modified":"2026-11-07T07:15:04Z","fixes":[{"ecosystem":"PyPI","package":"pyjwt","fixed_in":["2.14.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-jwt","fixed_in":["2.15.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-jwt","fixed_in":["2.15.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-jwt","fixed_in":["2.15.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pyjwt","fixed_in":["2.14.0-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"pyjwt","fixed_in":["2.13.0+aikido.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"PyJWT","fixed_in":["2.13.0+aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyjwt","fixed_in":["1.3.0-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyjwt","fixed_in":["1.5.3+ds1-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyjwt","fixed_in":["1.7.1-2ubuntu2.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pyjwt","fixed_in":["2.3.0-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pyjwt","fixed_in":["2.7.0-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"pyjwt","fixed_in":["2.13.0-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pyjwt","fixed_in":["2.10.1-4ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"last_affected":"2.13.0"},{"fixed":"2.14.0"}]}],"versions":["2.13.0"]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-aliyun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-amt-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-apc-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-azure-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-bladecenter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-cisco-ucs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-drac5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-hpblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-ibm-powervs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-ibm-vpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-ibmblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-ifmib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-ilo-moonshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-ilo-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-lpar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-mpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-nutanix-ahv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-redfish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-scsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-virsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-agents-vmware-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-virtd-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-virtd-multicast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fence-virtd-serial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ha-cloud-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-aliyun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-amt-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-apc-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-azure-arm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-bladecenter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-brocade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-cisco-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-cisco-ucs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-drac5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-eaton-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-emerson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-eps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-heuristics-ping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-hpblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ibm-powervs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ibm-vpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ibmblade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ifmib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ilo-moonshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ilo-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ilo-ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ilo2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-intelmodular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ipdu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-ipmilan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-lpar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-mpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-nutanix-ahv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-redfish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-rsb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-sbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-scsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-virsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-vmware-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-vmware-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-wti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-agents-zvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virtd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virtd-cpg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virtd-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virtd-multicast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virtd-serial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"fence-virtd-tcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ha-cloud-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.1-r0"},{"fixed":"2.15.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0-r1"},{"fixed":"2.15.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.1"},{"fixed":"2.10.1.post8+tuxcare"}]}],"versions":["2.10.1","2.10.1.post1+tuxcare","2.10.1.post2+tuxcare","2.10.1.post3+tuxcare","2.10.1.post4+tuxcare","2.10.1.post5+tuxcare","2.10.1.post6+tuxcare","2.10.1.post7+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.0.post6+tuxcare"}]}],"versions":["2.8.0","2.8.0.post1+tuxcare","2.8.0.post2+tuxcare","2.8.0.post3+tuxcare","2.8.0.post4+tuxcare","2.8.0.post5+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.0.post6+tuxcare"}]}],"versions":["2.3.0","2.3.0.post1+tuxcare","2.3.0.post2+tuxcare","2.3.0.post3+tuxcare","2.3.0.post4+tuxcare","2.3.0.post5+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Debian:13","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.1-2","2.10.1-2+deb13u1","2.10.1-3","2.10.1-4","2.11.0-2","2.12.1-1","2.13.0-1","2.14.0-1","2.15.0-1","2.15.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-1"}]}],"versions":["2.10.1-2","2.10.1-3","2.10.1-4","2.11.0-2","2.12.1-1","2.13.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.14.0"}]}],"versions":["2.13.0"]},{"source":"osv","ecosystem":"PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.14.0"}]}],"versions":["2.13.0"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"fence-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-110.el9_8.8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"fence-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-21.el10_2.7"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:PyPI","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0+aikido.1"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"PyJWT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0+aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1+esm3"}]}],"versions":["1.0.0-0ubuntu1","1.3.0-1","1.3.0-1ubuntu0.1","1.3.0-1ubuntu0.1+esm1","1.3.0-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+ds1-1ubuntu0.1+esm3"}]}],"versions":["1.4.2-1.1","1.5.3+ds1-1","1.5.3+ds1-1ubuntu0.1","1.5.3+ds1-1ubuntu0.1+esm1","1.5.3+ds1-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2ubuntu2.1+esm3"}]}],"versions":["1.7.0-2","1.7.1-1","1.7.1-2ubuntu1","1.7.1-2ubuntu2","1.7.1-2ubuntu2.1","1.7.1-2ubuntu2.1+esm1","1.7.1-2ubuntu2.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu0.5"}]}],"versions":["1.7.1-2ubuntu2","2.1.0-1","2.3.0-1","2.3.0-1ubuntu0.1","2.3.0-1ubuntu0.2","2.3.0-1ubuntu0.3","2.3.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1ubuntu0.3"}]}],"versions":["2.7.0-1","2.7.0-1ubuntu0.1","2.7.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-1ubuntu1"}]}],"versions":["2.10.1-4ubuntu1","2.12.1-1","2.13.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-4ubuntu1.2"}]}],"versions":["2.10.1-2","2.10.1-3","2.10.1-3build1","2.10.1-4","2.10.1-4ubuntu1","2.10.1-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1+esm3"}]}],"versions":["1.0.0-0ubuntu1","1.3.0-1","1.3.0-1ubuntu0.1","1.3.0-1ubuntu0.1+esm1","1.3.0-1ubuntu0.1+esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+ds1-1ubuntu0.1+esm3"}]}],"versions":["1.4.2-1.1","1.5.3+ds1-1","1.5.3+ds1-1ubuntu0.1","1.5.3+ds1-1ubuntu0.1+esm1","1.5.3+ds1-1ubuntu0.1+esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2ubuntu2.1+esm3"}]}],"versions":["1.7.0-2","1.7.1-1","1.7.1-2ubuntu1","1.7.1-2ubuntu2","1.7.1-2ubuntu2.1","1.7.1-2ubuntu2.1+esm1","1.7.1-2ubuntu2.1+esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu0.5"}]}],"versions":["1.7.1-2ubuntu2","2.1.0-1","2.3.0-1","2.3.0-1ubuntu0.1","2.3.0-1ubuntu0.2","2.3.0-1ubuntu0.3","2.3.0-1ubuntu0.4"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1ubuntu0.3"}]}],"versions":["2.7.0-1","2.7.0-1ubuntu0.1","2.7.0-1ubuntu0.2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-4ubuntu1.2"}]}],"versions":["2.10.1-2","2.10.1-3","2.10.1-3build1","2.10.1-4","2.10.1-4ubuntu1","2.10.1-4ubuntu1.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-1ubuntu1"}]}],"versions":["2.10.1-4ubuntu1","2.12.1-1","2.13.0-1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-PyJWT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1-1.1"}]}],"bundled":9}],"products":[{"vendor":"jpadilla","product":"pyjwt"},{"vendor":"pyjwt_project","product":"pyjwt"}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102272","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r6x4-923q-g947","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94500","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102266","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102267","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102268","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102271","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102272","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542671","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542685","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542687","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542690","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542695","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-94500.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94501","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-94501.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-102272","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102272.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102272","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt","tags":["package"]},{"url":"https://pypi.org/project/pyjwt","tags":["package"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94500","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542695","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94501","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102272","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8916-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8916-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102273","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-102272","title":"PyJWT BOM Bypass","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T20:36:31.53Z","modified":"2026-09-29T14:45:44.138Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-88540","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T20:36:31Z","modified":"2026-09-29T14:45:44Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:52.331616Z"}],"ghsa":[{"id":"GHSA-r6x4-923q-g947","title":"PyJWT BOM Bypass","description":"## Affected Package\n\n- **Package**: PyJWT (`pyjwt` on PyPI)\n- **Repository**: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt\u0026source=gmail\u0026ust=1781794518474000\u0026sa=E\n- **Affected version**: 2.13.0\n- **Vulnerability class**: Algorithm confusion / patch bypass\n\n---\n\n## Root Cause\n\nPyJWT 2.13.0 introduced a guard in `HMACAlgorithm.prepare_key()` (file `jwt/algorithms.py`, approximately line 344) to prevent RSA public key material from being used as an HMAC secret — the root cause of CVE-2026-48526.\n\nThe guard uses `bytes.lstrip()` before calling `startswith(b\"{\")`:\n\n```python\nstripped = key_bytes.lstrip() # strips ASCII whitespace only\nif stripped.startswith(b\"{\"): # JWK detection\n ...\n raise InvalidKeyError(\"The specified key is an asymmetric key...\")\n```\n\n`bytes.lstrip()` with no argument removes only bytes in the ASCII whitespace set (`\\x20 \\t \\n \\r \\x0b \\x0c`). A UTF-8 BOM prefix (`\\xef\\xbb\\xbf`) is not stripped, so `stripped.startswith(b\"{\")` returns `False` for any BOM-prefixed JWK JSON. The JWK detection block is never entered, and the RSA public key bytes are silently accepted as the HMAC-SHA256 secret.\n\n---\n\n## PoC Sketch (pseudocode — not a weaponized payload)\n\n```python\n# 1. Attacker obtains RSA public key JWK (e.g., from /jwks.json endpoint)\n# and prepends a UTF-8 BOM byte sequence before the JSON opening brace.\n# 2. Attacker signs a JWT using HS256, with the BOM-prefixed JWK as the secret.\n# 3. Attacker submits the forged token to a verifier that:\n# - accepts algorithms=[\"HS256\", \"RS256\"]\n# - holds the same RSA public key as raw bytes (BOM-prefixed key file)\n# 4. PyJWT 2.13.0 accepts the token because the BOM causes the JWK\n# detection check to be skipped — the RSA JWK bytes become a valid HMAC key.\n# Result: arbitrary claims (role, sub, etc.) accepted by the verifier.\n```\n\n---\n\n## Impact\n\nAn unauthenticated network attacker who knows the target application's RSA public key — which is public by design and obtainable from a JWKS endpoint or certificate — can forge JWT tokens containing arbitrary claims and have them accepted by a PyJWT 2.13.0 verifier configured with a mixed algorithm set (`algorithms=[\"HS256\", \"RS256\"]` or equivalent). The resulting impact\nis complete authentication and authorization bypass (`C:H/I:H`). Attack Complexity is High (`AC:H`) because the attacker must obtain the RSA public key and the verifier must use a mixed-algorithm configuration; no authentication is required (`PR:N`). This is a patch bypass: users who upgraded to 2.13.0 specifically to remediate CVE-2026-48526 remain vulnerable.\n\n---\n\n## Suggested Fix\n\n**Option A (minimal)**: Replace `lstrip()` with an explicit strip of known\nBOM prefixes before the JSON detection check:\n\n```python\n# Strip common BOM prefixes in addition to ASCII whitespace\nBOM_PREFIXES = (b\"\\xef\\xbb\\xbf\", b\"\\xff\\xfe\", b\"\\xfe\\xff\")\nstripped = key_bytes\nfor bom in BOM_PREFIXES:\n if stripped.startswith(bom):\n stripped = stripped[len(bom):]\n break\nstripped = stripped.lstrip()\n```\n\n**Option B (more robust)**: Use `json.loads()` as the detection mechanism\ninstead of a byte-prefix check, so encoding variants and whitespace are\nhandled by the JSON parser:\n\n```python\ntry:\n test_obj = json.loads(key_bytes.strip())\n if isinstance(test_obj, dict) and \"kty\" in test_obj:\n raise InvalidKeyError(\"The specified key is an asymmetric key...\")\nexcept (ValueError, UnicodeDecodeError):\n pass\n```\n\nOption B is preferred because it is resilient to any future encoding variant.\n\n---\n\n## Maintainer update — 2026-09-09\n\nWe reproduced the reported algorithm-confusion path on PyJWT 2.13.0. When an application passes a raw public RSA JWK as the key and allows both an asymmetric and HMAC algorithm, a forged HS256 token signed with the known public JWK bytes is accepted when the JWK is represented in encodings accepted by Python's JSON decoder. The normal raw-JWK, asymmetric-only, and algorithm-bound `PyJWK` controls reject the token. This is an application configuration precondition, but the bypass is in PyJWT's own raw-JWK validation guard and is in scope under the PyJWT security policy.\n\nThe fix is committed as `180783930de91876bc0d601f826a1f2956057291`. `HMACAlgorithm.prepare_key()` now checks parsed JSON objects for `kty` across accepted UTF-8/16/32 representations, preserves non-JWK HMAC key bytes, and conservatively rejects deeply nested JSON objects even when parsing reaches the recursion guard. Regression coverage includes BOM and BOM-less encodings, deep non-JWK keys, deep JWK objects, and unpaired-surrogate cases.\n\nThe full suite passes with 391 tests and 4 intentional cryptography-environment skips. A fresh Astra/max independent review accepted commit `180783930de91876bc0d601f826a1f2956057291`. It independently confirmed encoding/BOM handling, recursion and surrogate behavior, preservation of non-object key compatibility, and the reported test results.\n\nThe fix has not been released. The advisory remains High with its existing CVSS 3.1 score of 7.4, and the patched version remains unset pending release planning.\n\n## Classification update — 2026-09-10\n\nWe completed the advisory classification review. The proposed CVSS 3.1 vector is `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` and the proposed CWE classification is CWE-347. These classifications reflect the documented impact and do not alter the affected range, fix status, or lifecycle state.\n\n## Maintainer update — 2026-09-11\n\nThe verified fix for this advisory is included in PyJWT 2.14.0, released on 2026-09-11 and available on PyPI. PyJWT 2.14.0 is the first release containing the fix. This advisory is now published with 2.14.0 recorded as the patched version.","status":"published","published":"2026-09-29T23:14:00Z","modified":"2026-09-29T23:14:02Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-102272","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T21:17:15.28Z","modified":"2026-10-06T18:34:24.71Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:52.413234Z"}],"osv":[{"id":"BELL-CVE-2026-102272","status":"published","published":"2026-10-01T06:08:33.92289Z","modified":"2026-11-07T07:15:04.400354741Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-07T07:40:27.39378Z"},{"id":"CVE-2026-102272","title":"PyJWT BOM Bypass","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T20:36:31.53Z","modified":"2026-11-04T16:57:05.358638659Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"DEBIAN-CVE-2026-102272","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T21:17:15.28Z","modified":"2026-10-07T09:47:34.451300403Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-r6x4-923q-g947","title":"PyJWT BOM Bypass","description":"## Affected Package\n\n- **Package**: PyJWT (`pyjwt` on PyPI)\n- **Repository**: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt\u0026source=gmail\u0026ust=1781794518474000\u0026sa=E\n- **Affected version**: 2.13.0\n- **Vulnerability class**: Algorithm confusion / patch bypass\n\n---\n\n## Root Cause\n\nPyJWT 2.13.0 introduced a guard in `HMACAlgorithm.prepare_key()` (file `jwt/algorithms.py`, approximately line 344) to prevent RSA public key material from being used as an HMAC secret — the root cause of CVE-2026-48526.\n\nThe guard uses `bytes.lstrip()` before calling `startswith(b\"{\")`:\n\n```python\nstripped = key_bytes.lstrip() # strips ASCII whitespace only\nif stripped.startswith(b\"{\"): # JWK detection\n ...\n raise InvalidKeyError(\"The specified key is an asymmetric key...\")\n```\n\n`bytes.lstrip()` with no argument removes only bytes in the ASCII whitespace set (`\\x20 \\t \\n \\r \\x0b \\x0c`). A UTF-8 BOM prefix (`\\xef\\xbb\\xbf`) is not stripped, so `stripped.startswith(b\"{\")` returns `False` for any BOM-prefixed JWK JSON. The JWK detection block is never entered, and the RSA public key bytes are silently accepted as the HMAC-SHA256 secret.\n\n---\n\n## PoC Sketch (pseudocode — not a weaponized payload)\n\n```python\n# 1. Attacker obtains RSA public key JWK (e.g., from /jwks.json endpoint)\n# and prepends a UTF-8 BOM byte sequence before the JSON opening brace.\n# 2. Attacker signs a JWT using HS256, with the BOM-prefixed JWK as the secret.\n# 3. Attacker submits the forged token to a verifier that:\n# - accepts algorithms=[\"HS256\", \"RS256\"]\n# - holds the same RSA public key as raw bytes (BOM-prefixed key file)\n# 4. PyJWT 2.13.0 accepts the token because the BOM causes the JWK\n# detection check to be skipped — the RSA JWK bytes become a valid HMAC key.\n# Result: arbitrary claims (role, sub, etc.) accepted by the verifier.\n```\n\n---\n\n## Impact\n\nAn unauthenticated network attacker who knows the target application's RSA public key — which is public by design and obtainable from a JWKS endpoint or certificate — can forge JWT tokens containing arbitrary claims and have them accepted by a PyJWT 2.13.0 verifier configured with a mixed algorithm set (`algorithms=[\"HS256\", \"RS256\"]` or equivalent). The resulting impact\nis complete authentication and authorization bypass (`C:H/I:H`). Attack Complexity is High (`AC:H`) because the attacker must obtain the RSA public key and the verifier must use a mixed-algorithm configuration; no authentication is required (`PR:N`). This is a patch bypass: users who upgraded to 2.13.0 specifically to remediate CVE-2026-48526 remain vulnerable.\n\n---\n\n## Suggested Fix\n\n**Option A (minimal)**: Replace `lstrip()` with an explicit strip of known\nBOM prefixes before the JSON detection check:\n\n```python\n# Strip common BOM prefixes in addition to ASCII whitespace\nBOM_PREFIXES = (b\"\\xef\\xbb\\xbf\", b\"\\xff\\xfe\", b\"\\xfe\\xff\")\nstripped = key_bytes\nfor bom in BOM_PREFIXES:\n if stripped.startswith(bom):\n stripped = stripped[len(bom):]\n break\nstripped = stripped.lstrip()\n```\n\n**Option B (more robust)**: Use `json.loads()` as the detection mechanism\ninstead of a byte-prefix check, so encoding variants and whitespace are\nhandled by the JSON parser:\n\n```python\ntry:\n test_obj = json.loads(key_bytes.strip())\n if isinstance(test_obj, dict) and \"kty\" in test_obj:\n raise InvalidKeyError(\"The specified key is an asymmetric key...\")\nexcept (ValueError, UnicodeDecodeError):\n pass\n```\n\nOption B is preferred because it is resilient to any future encoding variant.\n\n---\n\n## Maintainer update — 2026-09-09\n\nWe reproduced the reported algorithm-confusion path on PyJWT 2.13.0. When an application passes a raw public RSA JWK as the key and allows both an asymmetric and HMAC algorithm, a forged HS256 token signed with the known public JWK bytes is accepted when the JWK is represented in encodings accepted by Python's JSON decoder. The normal raw-JWK, asymmetric-only, and algorithm-bound `PyJWK` controls reject the token. This is an application configuration precondition, but the bypass is in PyJWT's own raw-JWK validation guard and is in scope under the PyJWT security policy.\n\nThe fix is committed as `180783930de91876bc0d601f826a1f2956057291`. `HMACAlgorithm.prepare_key()` now checks parsed JSON objects for `kty` across accepted UTF-8/16/32 representations, preserves non-JWK HMAC key bytes, and conservatively rejects deeply nested JSON objects even when parsing reaches the recursion guard. Regression coverage includes BOM and BOM-less encodings, deep non-JWK keys, deep JWK objects, and unpaired-surrogate cases.\n\nThe full suite passes with 391 tests and 4 intentional cryptography-environment skips. A fresh Astra/max independent review accepted commit `180783930de91876bc0d601f826a1f2956057291`. It independently confirmed encoding/BOM handling, recursion and surrogate behavior, preservation of non-object key compatibility, and the reported test results.\n\nThe fix has not been released. The advisory remains High with its existing CVSS 3.1 score of 7.4, and the patched version remains unset pending release planning.\n\n## Classification update — 2026-09-10\n\nWe completed the advisory classification review. The proposed CVSS 3.1 vector is `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` and the proposed CWE classification is CWE-347. These classifications reflect the documented impact and do not alter the affected range, fix status, or lifecycle state.\n\n## Maintainer update — 2026-09-11\n\nThe verified fix for this advisory is included in PyJWT 2.14.0, released on 2026-09-11 and available on PyPI. PyJWT 2.14.0 is the first release containing the fix. This advisory is now published with 2.14.0 recorded as the patched version.","status":"published","published":"2026-09-29T23:14:00Z","modified":"2026-10-01T17:56:05.452379838Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"PYSEC-2026-4150","title":"PyJWT BOM Bypass","description":"## Affected Package\n\n- **Package**: PyJWT (`pyjwt` on PyPI)\n- **Repository**: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt\u0026source=gmail\u0026ust=1781794518474000\u0026sa=E\n- **Affected version**: 2.13.0\n- **Vulnerability class**: Algorithm confusion / patch bypass\n\n---\n\n## Root Cause\n\nPyJWT 2.13.0 introduced a guard in `HMACAlgorithm.prepare_key()` (file `jwt/algorithms.py`, approximately line 344) to prevent RSA public key material from being used as an HMAC secret — the root cause of CVE-2026-48526.\n\nThe guard uses `bytes.lstrip()` before calling `startswith(b\"{\")`:\n\n```python\nstripped = key_bytes.lstrip() # strips ASCII whitespace only\nif stripped.startswith(b\"{\"): # JWK detection\n ...\n raise InvalidKeyError(\"The specified key is an asymmetric key...\")\n```\n\n`bytes.lstrip()` with no argument removes only bytes in the ASCII whitespace set (`\\x20 \\t \\n \\r \\x0b \\x0c`). A UTF-8 BOM prefix (`\\xef\\xbb\\xbf`) is not stripped, so `stripped.startswith(b\"{\")` returns `False` for any BOM-prefixed JWK JSON. The JWK detection block is never entered, and the RSA public key bytes are silently accepted as the HMAC-SHA256 secret.\n\n---\n\n## PoC Sketch (pseudocode — not a weaponized payload)\n\n```python\n# 1. Attacker obtains RSA public key JWK (e.g., from /jwks.json endpoint)\n# and prepends a UTF-8 BOM byte sequence before the JSON opening brace.\n# 2. Attacker signs a JWT using HS256, with the BOM-prefixed JWK as the secret.\n# 3. Attacker submits the forged token to a verifier that:\n# - accepts algorithms=[\"HS256\", \"RS256\"]\n# - holds the same RSA public key as raw bytes (BOM-prefixed key file)\n# 4. PyJWT 2.13.0 accepts the token because the BOM causes the JWK\n# detection check to be skipped — the RSA JWK bytes become a valid HMAC key.\n# Result: arbitrary claims (role, sub, etc.) accepted by the verifier.\n```\n\n---\n\n## Impact\n\nAn unauthenticated network attacker who knows the target application's RSA public key — which is public by design and obtainable from a JWKS endpoint or certificate — can forge JWT tokens containing arbitrary claims and have them accepted by a PyJWT 2.13.0 verifier configured with a mixed algorithm set (`algorithms=[\"HS256\", \"RS256\"]` or equivalent). The resulting impact\nis complete authentication and authorization bypass (`C:H/I:H`). Attack Complexity is High (`AC:H`) because the attacker must obtain the RSA public key and the verifier must use a mixed-algorithm configuration; no authentication is required (`PR:N`). This is a patch bypass: users who upgraded to 2.13.0 specifically to remediate CVE-2026-48526 remain vulnerable.\n\n---\n\n## Suggested Fix\n\n**Option A (minimal)**: Replace `lstrip()` with an explicit strip of known\nBOM prefixes before the JSON detection check:\n\n```python\n# Strip common BOM prefixes in addition to ASCII whitespace\nBOM_PREFIXES = (b\"\\xef\\xbb\\xbf\", b\"\\xff\\xfe\", b\"\\xfe\\xff\")\nstripped = key_bytes\nfor bom in BOM_PREFIXES:\n if stripped.startswith(bom):\n stripped = stripped[len(bom):]\n break\nstripped = stripped.lstrip()\n```\n\n**Option B (more robust)**: Use `json.loads()` as the detection mechanism\ninstead of a byte-prefix check, so encoding variants and whitespace are\nhandled by the JSON parser:\n\n```python\ntry:\n test_obj = json.loads(key_bytes.strip())\n if isinstance(test_obj, dict) and \"kty\" in test_obj:\n raise InvalidKeyError(\"The specified key is an asymmetric key...\")\nexcept (ValueError, UnicodeDecodeError):\n pass\n```\n\nOption B is preferred because it is resilient to any future encoding variant.\n\n---\n\n## Maintainer update — 2026-09-09\n\nWe reproduced the reported algorithm-confusion path on PyJWT 2.13.0. When an application passes a raw public RSA JWK as the key and allows both an asymmetric and HMAC algorithm, a forged HS256 token signed with the known public JWK bytes is accepted when the JWK is represented in encodings accepted by Python's JSON decoder. The normal raw-JWK, asymmetric-only, and algorithm-bound `PyJWK` controls reject the token. This is an application configuration precondition, but the bypass is in PyJWT's own raw-JWK validation guard and is in scope under the PyJWT security policy.\n\nThe fix is committed as `180783930de91876bc0d601f826a1f2956057291`. `HMACAlgorithm.prepare_key()` now checks parsed JSON objects for `kty` across accepted UTF-8/16/32 representations, preserves non-JWK HMAC key bytes, and conservatively rejects deeply nested JSON objects even when parsing reaches the recursion guard. Regression coverage includes BOM and BOM-less encodings, deep non-JWK keys, deep JWK objects, and unpaired-surrogate cases.\n\nThe full suite passes with 391 tests and 4 intentional cryptography-environment skips. A fresh Astra/max independent review accepted commit `180783930de91876bc0d601f826a1f2956057291`. It independently confirmed encoding/BOM handling, recursion and surrogate behavior, preservation of non-object key compatibility, and the reported test results.\n\nThe fix has not been released. The advisory remains High with its existing CVSS 3.1 score of 7.4, and the patched version remains unset pending release planning.\n\n## Classification update — 2026-09-10\n\nWe completed the advisory classification review. The proposed CVSS 3.1 vector is `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` and the proposed CWE classification is CWE-347. These classifications reflect the documented impact and do not alter the affected range, fix status, or lifecycle state.\n\n## Maintainer update — 2026-09-11\n\nThe verified fix for this advisory is included in PyJWT 2.14.0, released on 2026-09-11 and available on PyPI. PyJWT 2.14.0 is the first release containing the fix. This advisory is now published with 2.14.0 recorded as the patched version.","status":"published","published":"2026-10-01T16:38:40.289982Z","modified":"2026-10-01T17:45:17.841640641Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"},{"id":"RLSA-2026:94500","title":"Critical: fence-agents security update","description":"The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. \n\nSecurity Fix(es):\n\n* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)\n\n* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)\n\n* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)\n\n* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)\n\n* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-04T09:06:07.045237Z","modified":"2026-11-04T09:45:03.398492219Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"RLSA-2026:94501","title":"Critical: fence-agents security update","description":"The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. \n\nSecurity Fix(es):\n\n* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)\n\n* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)\n\n* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)\n\n* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)\n\n* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-04T09:10:56.529723Z","modified":"2026-11-04T09:45:02.465082724Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"UBUNTU-CVE-2026-102272","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T21:17:00Z","modified":"2026-10-27T11:56:51.134433423Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"ALSA-2026:94500","title":"Critical: fence-agents security update","description":"The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   \n\nSecurity Fix(es):  \n\n  * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)\n  * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)\n  * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)\n  * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)\n  * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T16:45:02.633802593Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"ALSA-2026:94501","title":"Critical: fence-agents security update","description":"The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.   \n\nSecurity Fix(es):  \n\n  * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)\n  * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)\n  * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)\n  * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)\n  * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T16:45:02.622042393Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"AZL-105224","title":"CVE-2026-102272 affecting package python-jwt for versions less than 2.15.1-1","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","status":"published","published":"2026-09-28T21:17:15Z","modified":"2026-11-02T14:17:23.241084567Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"CLSA-2026-1793606235","title":"TuxCare security update for pyjwt (3 CVEs)","description":"TuxCare rebuilt pyjwt to address 3 CVEs. Fixed in 2.10.1.post8+tuxcare.","status":"published","published":"2026-11-02T08:57:16Z","modified":"2026-11-02T14:45:02.366368926Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793698392","title":"TuxCare security update for pyjwt (4 CVEs)","description":"TuxCare rebuilt pyjwt to address 4 CVEs. Fixed in 2.8.0.post6+tuxcare.","status":"published","published":"2026-11-03T10:33:13Z","modified":"2026-11-03T13:30:02.621922113Z","updated_at":"2026-11-03T14:04:50.729288Z"},{"id":"CLSA-2026-1793869522","title":"TuxCare security update for pyjwt (3 CVEs)","description":"TuxCare rebuilt pyjwt to address 3 CVEs. Fixed in 2.3.0.post6+tuxcare.","status":"published","published":"2026-11-05T10:05:23Z","modified":"2026-11-05T13:15:16.176643255Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"openSUSE-SU-2026:11994-1","title":"python313-PyJWT-2.15.1-1.1 on GA media","description":"These are all security issues fixed in the python313-PyJWT-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:15.811415752Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-PYPI-CVE-2026-102272","title":"CVE-2026-102272 in pyjwt - Patched by Root","description":"Root has patched CVE-2026-102272 in the pyjwt package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-02T07:34:59Z","modified":"2026-11-02T08:15:03.270045452Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"USN-8916-1","title":"pyjwt vulnerabilities","description":"YuSung Han discovered that PyJWT did not properly validate certain JWK keys\nwhen performing HMAC verification. An attacker could possibly use this\nissue to forge authentication tokens. This issue only affected  Ubuntu\n26.04 LTS. (CVE-2026-102266)\n\nRohan Das discovered that PyJWT incorrectly handled redirects when fetching\nkey sets. A remote attacker could possibly use this issue to  cause PyJWT\nto disclose sensitive information. This issue only affected Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS. (CVE-2026-102267)\n\nIt was discovered that PyJWT incorrectly recognized certain PEM\nrepresentations. An attacker who knew the public key could possibly use\nthis issue to forge authentication tokens. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu\n26.04 LTS. (CVE-2026-102268)\n\nNuno Lopes discovered that PyJWT incorrectly handled DER public keys when\nperforming HMAC verification. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102271)\n\nIt was discovered that PyJWT did not properly handle certain JWK keys\nprefixed with a byte-order mark. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102272)\n\nCharles Vosburgh discovered that PyJWT incorrectly handled certain JWK\ncontainers when performing HMAC verification. An attacker who knew the\npublic key could possibly use this issue to forge authentication tokens.\n(CVE-2026-102273)","status":"published","published":"2026-10-13T10:09:47Z","modified":"2026-10-27T11:56:51.412224735Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8916-2","title":"pyjwt vulnerabilities","description":"USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the\ncorresponding fix for PyJWT on Ubuntu 26.10.\n\nOriginal advisory details:\n\nYuSung Han discovered that PyJWT did not properly validate certain JWK keys\nwhen performing HMAC verification. An attacker could possibly use this\nissue to forge authentication tokens. (CVE-2026-102266)\n\nRohan Das discovered that PyJWT incorrectly handled redirects when fetching\nkey sets. A remote attacker could possibly use this issue to  cause PyJWT\nto disclose sensitive information. (CVE-2026-102267)\n\nIt was discovered that PyJWT incorrectly recognized certain PEM\nrepresentations. An attacker who knew the public key could possibly use\nthis issue to forge authentication tokens. (CVE-2026-102268)\n\nNuno Lopes discovered that PyJWT incorrectly handled DER public keys when\nperforming HMAC verification. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102271)\n\nIt was discovered that PyJWT did not properly handle certain JWK keys\nprefixed with a byte-order mark. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102272)\n\nCharles Vosburgh discovered that PyJWT incorrectly handled certain JWK\ncontainers when performing HMAC verification. An attacker who knew the\npublic key could possibly use this issue to forge authentication tokens.\n(CVE-2026-102273)","status":"published","published":"2026-10-15T06:24:37Z","modified":"2026-10-27T11:56:51.258716356Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}