VDB
CVE-2026-102273
CVE-2026-102273
PUBLISHED
CVSS 7.4 HIGH
Reported by GitHub_M · Published September 28, 2026
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.
Risk Scores
CVSS 3.1
7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| jpadilla | pyjwt | >= 2.13.0, < 2.14.0 |
| chainguard | kserve-huggingfaceserver-cuda-13.3 | 0 |
| chainguard | authentik-fips-2026.5 | 0 |
| chainguard | kserve | 0 |
| wolfi | py3-cassandra-medusa | 0 |
| chainguard | openstack-nova-2025.1 | 0 |
| chainguard | datadog-agent-7.79 | 0 |
| chainguard | openstack-placement-2026.1-fips | 0 |
| chainguard | openstack-designate-2026.1 | 0 |
| chainguard | openstack-placement-2025.1 | 0 |
| chainguard | netbox-fips | 0 |
| chainguard | openstack-keystone-2025.2 | 0 |
| chainguard | azureml-inference-server-http | 0 |
| chainguard | datadog-agent-fips-7.83 | 0 |
| chainguard | superset-fips-6.1 | 0 |
| chainguard | openstack-keystone-2025.2-fips | 0 |
| chainguard | litellm | 0 |
| jpadilla | pyjwt | 2.13.0 |
| amazon:2023 | python3-jwt | 0 |
| chainguard | openstack-horizon-2025.2-fips | 0 |
…and 65 more
Timeline
- Sep 28, 2026 CVE Published
- Sep 29, 2026 CVE Updated
- Sep 29, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w x_refsource_CONFIRM
- https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95 x_refsource_MISC
- https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-102273 advisory
- https://github.com/advisories/GHSA-w2cx-738m-mc7w advisory