CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/463.html
• https://cwe.mitre.org/data/definitions/475.html

References

• https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w