CVE-2026-102266

Received Received - Intake

HMAC Token Forgery in PyJWT Library

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-102266

EUVD

EUVD-2026-88484

Affected Vendors & Products

Vendor	Product	Version / Range
pyjwt	pyjwt	to 2.14.0 (exc)
pyjwt	pyjwt	2.14.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

PyJWT versions 2.13.0 to 2.14.0 have a flaw in HMACAlgorithm.from_jwk where it accepts a zero-length key from a trusted JWK Set. This allows attackers to forge HMAC tokens with arbitrary claims using the empty key.

Detection Guidance

Check PyJWT version with pip show PyJWT. If version is between 2.13.0 and 2.14.0, the system is vulnerable. Review JWK Set configurations for oct entries with empty k values.

Impact Analysis

An attacker could impersonate users or escalate privileges by forging tokens with fake claims. Systems relying on PyJWT for authentication may grant unauthorized access to sensitive data or functions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity/confidentiality principles and HIPAA's access controls. Organizations may face compliance breaches if exploited.

Mitigation Strategies

Upgrade PyJWT to version 2.14.0 or later. If using JWK Sets, ensure no oct entries have empty k values. Validate all JWT tokens with the updated library.

Hi! I’m here to help you understand CVE-2026-102266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70