How severe is CVE-2026-102273?

CVE-2026-102273 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-102273 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-102273?

CVE-2026-102273 affects Pyjwt Project Pyjwt. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-102273?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-102273 published?

CVE-2026-102273 was published on 2026-09-28 and last updated on 2026-10-06.

CVE-2026-102273

CVE-2026-102273 is a high-severity vulnerability in Pyjwt Project Pyjwt with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-347.

Key facts

Severity: High (CVSS 3.x base score 7.4)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-347
Affected product: Pyjwt Project Pyjwt
Published: 2026-09-28
Last modified: 2026-10-06

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Frequently asked questions

What is CVE-2026-102273?: PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.
How severe is CVE-2026-102273?: CVE-2026-102273 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-102273 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-102273?: CVE-2026-102273 affects Pyjwt Project Pyjwt. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-102273?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-102273 published?: CVE-2026-102273 was published on 2026-09-28 and last updated on 2026-10-06.

References

Affected products (1)

cpe:2.3:a:pyjwt_project:pyjwt:2.13.0:*:*:*:*:*:*:*

More vulnerabilities in Pyjwt Project Pyjwt

CVE-2026-32597 — High (CVSS 7.5): PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header…
CVE-2017-11424 — High (CVSS 7.5): In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM…
CVE-2026-102272 — High (CVSS 7.4): PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in…
CVE-2026-102271 — High (CVSS 7.4): PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key…
CVE-2026-48526 — High (CVSS 7.4): PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens,…
CVE-2022-29217 — High (CVSS 7.4): PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an…

All CVEs affecting Pyjwt Project Pyjwt →

Other CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities

CVE-2026-5430 — Critical (CVSS 10.0): The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or…
CVE-2026-56451 — Critical (CVSS 10.0): A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly…
CVE-2026-48558 — Critical (CVSS 10.0): SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the…
CVE-2023-25574 — Critical (CVSS 10.0): `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI).…
CVE-2024-45409 — Critical (CVSS 10.0): The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <=…
CVE-2024-32962 — Critical (CVSS 10.0): xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default…

Browse all CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities →