Malformed RSA Key Vulnerability in PyJWT by Jpadilla
CVE-2026-102274

5.9MEDIUM

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102274?

PyJWT, a Python library for JSON Web Tokens, has a vulnerability affecting versions 2.9.0 to 2.14.0 where it fails to properly handle malformed RSA keys in JWK Set. This flaw occurs if the JWK Set contains an invalid RSA key, leading to an error that can disrupt the entire PyJWKSet creation process. As a result, this may cause authentication failures or denial of service at the request level. Users are advised to upgrade to version 2.14.0 or later to mitigate this issue.

Affected Version(s)

pyjwt >= 2.9.0, < 2.14.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0...
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.