CVE-2026-102266
CVE-2026-102266 · PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.
CVSS 7.4 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
pyjwt
- Versions
- >= 2.13.0, < 2.14.0: Affected
No fix published
pyjwt Debian:13
- Versions
- 2.10.1-2
- 2.10.1-2+deb13u1
- 2.10.1-3
- 2.10.1-4
- 2.11.0-2
- 2.12.1-1
- 2.13.0-1
- 2.14.0-1
- 2.15.0-1
- 2.15.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pyjwt Debian:14
- Versions
- 2.10.1-2
- 2.10.1-3
- 2.10.1-4
- 2.11.0-2
- 2.12.1-1
- 2.13.0-1
- Affected ranges
- ECOSYSTEM: < 2.14.0-1
Update to 2.14.0-1
pyjwt PyPI
- Versions
- 2.13.0
- Affected ranges
- ECOSYSTEM: ≥ 2.13.0, < 2.14.0
Update to 2.14.0
pyjwt Ubuntu:26.10
- Versions
- 2.10.1-4ubuntu1
- 2.12.1-1
- 2.13.0-1
- 2.13.0-1ubuntu1
- 2.13.0-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pyjwt Ubuntu:26.04:LTS
- Versions
- 2.10.1-2
- 2.10.1-3
- 2.10.1-3build1
- 2.10.1-4
- 2.10.1-4ubuntu1
- 2.10.1-4ubuntu1.1
- 2.10.1-4ubuntu1.2
- 2.10.1-4ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published