How severe is CVE-2026-102272?

CVE-2026-102272 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-102272 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-102272?

CVE-2026-102272 affects Pyjwt Project Pyjwt. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-102272?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-102272 published?

CVE-2026-102272 was published on 2026-09-28 and last updated on 2026-10-06.

CVE-2026-102272

CVE-2026-102272 is a high-severity vulnerability in Pyjwt Project Pyjwt with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-347.

Key facts

Severity: High (CVSS 3.x base score 7.4)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-347
Affected product: Pyjwt Project Pyjwt
Published: 2026-09-28
Last modified: 2026-10-06

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Frequently asked questions

What is CVE-2026-102272?: PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.
How severe is CVE-2026-102272?: CVE-2026-102272 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-102272 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-102272?: CVE-2026-102272 affects Pyjwt Project Pyjwt. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-102272?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-102272 published?: CVE-2026-102272 was published on 2026-09-28 and last updated on 2026-10-06.

References

Affected products (1)

cpe:2.3:a:pyjwt_project:pyjwt:2.13.0:*:*:*:*:*:*:*

More vulnerabilities in Pyjwt Project Pyjwt

CVE-2026-32597 — High (CVSS 7.5): PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header…
CVE-2017-11424 — High (CVSS 7.5): In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM…
CVE-2026-102273 — High (CVSS 7.4): PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key…
CVE-2026-102271 — High (CVSS 7.4): PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key…
CVE-2026-48526 — High (CVSS 7.4): PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens,…
CVE-2022-29217 — High (CVSS 7.4): PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an…

All CVEs affecting Pyjwt Project Pyjwt →

Other CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities

CVE-2026-5430 — Critical (CVSS 10.0): The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or…
CVE-2026-56451 — Critical (CVSS 10.0): A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly…
CVE-2026-48558 — Critical (CVSS 10.0): SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the…
CVE-2023-25574 — Critical (CVSS 10.0): `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI).…
CVE-2024-45409 — Critical (CVSS 10.0): The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <=…
CVE-2024-32962 — Critical (CVSS 10.0): xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default…

Browse all CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities →