How severe is CVE-2026-102271?

CVE-2026-102271 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-102271 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-102271?

CVE-2026-102271 affects Pyjwt Project Pyjwt. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-102271?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-102271 published?

CVE-2026-102271 was published on 2026-09-28 and last updated on 2026-10-06.

CVE-2026-102271

CVE-2026-102271 is a high-severity vulnerability in Pyjwt Project Pyjwt with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-347.

Key facts

Severity: High (CVSS 3.x base score 7.4)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-347
Affected product: Pyjwt Project Pyjwt
Published: 2026-09-28
Last modified: 2026-10-06

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

Frequently asked questions

What is CVE-2026-102271?: PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
How severe is CVE-2026-102271?: CVE-2026-102271 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-102271 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-102271?: CVE-2026-102271 affects Pyjwt Project Pyjwt. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-102271?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-102271 published?: CVE-2026-102271 was published on 2026-09-28 and last updated on 2026-10-06.

References

Affected products (1)

cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*

More vulnerabilities in Pyjwt Project Pyjwt

CVE-2026-32597 — High (CVSS 7.5): PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header…
CVE-2017-11424 — High (CVSS 7.5): In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM…
CVE-2026-102273 — High (CVSS 7.4): PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key…
CVE-2026-102272 — High (CVSS 7.4): PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in…
CVE-2026-48526 — High (CVSS 7.4): PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens,…
CVE-2022-29217 — High (CVSS 7.4): PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an…

All CVEs affecting Pyjwt Project Pyjwt →

Other CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities

CVE-2026-5430 — Critical (CVSS 10.0): The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or…
CVE-2026-56451 — Critical (CVSS 10.0): A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly…
CVE-2026-48558 — Critical (CVSS 10.0): SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the…
CVE-2023-25574 — Critical (CVSS 10.0): `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI).…
CVE-2024-45409 — Critical (CVSS 10.0): The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <=…
CVE-2024-32962 — Critical (CVSS 10.0): xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default…

Browse all CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities →