Asymmetric Key Management Flaw in PyJWT by Auth0
CVE-2026-102271

7.4HIGH

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102271?

The flaw in PyJWT affects versions 2.4.0 through 2.13.0, where improper management of asymmetric key verification allows attackers to manipulate HMAC tokens. The issue arises when HMAC and asymmetric algorithms are incorrectly used together, leading to the incorrect treatment of DER public keys as HMAC secrets. This vulnerability can potentially allow an attacker to forge authenticated HMAC tokens if they possess the public key. The problem has been resolved in version 2.14.0, which addresses the key handling issue.

Affected Version(s)

pyjwt >= 2.4.0, < 2.14.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/2798504fa2663364...
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.