CVE-2026-102273

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102273", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-28T20:11:16.658Z", "datePublished": "2026-09-28T20:38:28.161Z", "dateUpdated": "2026-09-29T13:44:49.200Z"}, "containers": {"cna": {"title": "PyJWT accepts public JWK containers as HMAC secrets", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"}, {"name": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95", "tags": ["x_refsource_MISC"], "url": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"}, {"name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"}], "affected": [{"vendor": "jpadilla", "product": "pyjwt", "versions": [{"version": ">= 2.13.0, < 2.14.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-28T20:38:28.161Z"}, "descriptions": [{"lang": "en", "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0."}], "source": {"advisory": "GHSA-w2cx-738m-mc7w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T13:39:56.542639Z", "id": "CVE-2026-102273", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T13:44:49.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "PyJWT accepts public JWK containers as HMAC secrets", "source": {"advisory": "GHSA-w2cx-738m-mc7w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jpadilla", "product": "pyjwt", "versions": [{"status": "affected", "version": ">= 2.13.0, < 2.14.0"}]}], "references": [{"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w", "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95", "name": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-28T20:38:28.161Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102273", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-29T13:39:56.542639Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-29T13:44:31.737Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-102273", "state": "PUBLISHED", "dateUpdated": "2026-09-28T20:38:28.161Z", "dateReserved": "2026-09-28T20:11:16.658Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-28T20:38:28.161Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pyjwt", "vendor": "jpadilla", "versions": [{"status": "affected", "version": ">= 2.13.0, < 2.14.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pyjwt_project:pyjwt:2.13.0:*:*:*:*:*:*:*", "matchCriteriaId": "2E8D3157-85D1-4276-A526-77BD2F16C9A3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0."}], "id": "CVE-2026-102273", "lastModified": "2026-10-06T18:29:42.883", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102273", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T13:39:56.542639Z", "version": "2.0.3"}}]}, "published": "2026-09-28T21:17:15.497", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets", "id": "2542697", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542697"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens (JWTs). When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key (JWK) container representations, mistakenly accepting public key material as a symmetric Hash-based Message Authentication Code (HMAC) secret. As a result, an attacker with knowledge of the public key can generate validly signed tokens with arbitrary authenticated claims."], "name": "CVE-2026-102273", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "jaeger", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "llvm21", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "swift-lang", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-28T20:38:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102273\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102273\nhttps://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95\nhttps://github.com/jpadilla/pyjwt/releases/tag/2.14.0\nhttps://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.13.0,2.14.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pyjwt", "source": "cna", "vendor": "jpadilla"}, "product": "pyjwt", "vendor": "jpadilla"}], "created": "2026-09-28T23:00:07.185614+00:00", "updated": "2026-09-28T23:00:07.774689+00:00", "vendors": ["jpadilla", "jpadilla$PRODUCT$pyjwt"]}