CVE-2026-102275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102275", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-28T20:11:16.658Z", "datePublished": "2026-09-28T20:46:33.169Z", "dateUpdated": "2026-09-29T13:56:09.869Z"}, "containers": {"cna": {"title": "PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-348", "lang": "en", "description": "CWE-348: Use of Less Trusted Source", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"}, {"name": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c", "tags": ["x_refsource_MISC"], "url": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c"}, {"name": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"}], "affected": [{"vendor": "jpadilla", "product": "pyjwt", "versions": [{"version": ">= 2.1.0, < 2.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-28T20:46:33.169Z"}, "descriptions": [{"lang": "en", "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0."}], "source": {"advisory": "GHSA-x33g-cr3x-6449", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T13:56:03.446684Z", "id": "CVE-2026-102275", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T13:56:09.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102275", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T13:56:03.446684Z"}}}], "references": [{"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T13:55:46.936Z"}}], "cna": {"title": "PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion", "source": {"advisory": "GHSA-x33g-cr3x-6449", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "jpadilla", "product": "pyjwt", "versions": [{"status": "affected", "version": ">= 2.1.0, < 2.15.0"}]}], "references": [{"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c", "name": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0", "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-348", "description": "CWE-348: Use of Less Trusted Source"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-28T20:46:33.169Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102275", "state": "PUBLISHED", "dateUpdated": "2026-09-29T13:56:09.869Z", "dateReserved": "2026-09-28T20:11:16.658Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-28T20:46:33.169Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pyjwt", "vendor": "jpadilla", "versions": [{"status": "affected", "version": ">= 2.1.0, < 2.15.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*", "matchCriteriaId": "19AC30FD-2D02-4370-BDB6-3F5EA8BA61FB", "versionEndExcluding": "2.15.0", "versionStartIncluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0."}], "id": "CVE-2026-102275", "lastModified": "2026-10-06T18:17:51.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102275", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T13:56:03.446684Z", "version": "2.0.3"}}]}, "published": "2026-09-28T21:17:15.857", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-348"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components", "id": "2542701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542701"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in PyJWT. When importing an Octet Key Pair (OKP) private JSON Web Key (JWK), the library does not verify that the public key component matches the private key component. In applications that accept private key parameters from proof headers, a remote attacker can exploit this discrepancy to bypass token verification and use a stolen sender-constrained token without possessing the legitimate private key."], "name": "CVE-2026-102275", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "jaeger", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "llvm21", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "swift-lang", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-28T20:46:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102275\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102275\nhttps://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c\nhttps://github.com/jpadilla/pyjwt/releases/tag/2.15.0\nhttps://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,2.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pyjwt", "source": "cna", "vendor": "jpadilla"}, "product": "pyjwt", "vendor": "jpadilla"}], "created": "2026-09-28T23:00:07.184208+00:00", "updated": "2026-09-30T04:45:19.218124+00:00", "vendors": ["jpadilla", "jpadilla$PRODUCT$pyjwt"], "weaknesses": ["CWE-345", "CWE-347", "CWE-348"]}