HMAC Vulnerability in PyJWT Affects Token Authentication
CVE-2026-102272

7.4HIGH

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102272?

The HMAC vulnerability in PyJWT versions 2.13.0 and below occurs due to improper handling of Unicode byte-order marks in JSON Web Tokens. When a public JWK is prefixed with a UTF-8 BOM, it can bypass the expected asymmetric-key detection, allowing the raw JWK to be misinterpreted as an HMAC secret. This flaw enables attackers with knowledge of the public key to forge valid authenticated tokens, compromising the integrity of the token verification process. The issue was addressed in PyJWT version 2.14.0.

Affected Version(s)

pyjwt >= 2.13.0, < 2.14.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/180783930de91876...
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.