CVE-2026-102273: PyJWT accepts public JWK containers as HMAC secrets
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyJWTto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
Which deployments are exposed to token forgery?
Deployments are exposed when they use affected PyJWT versions, allow both HMAC and asymmetric algorithms, and pass a public JWK container as the raw key. In that configuration, anyone who knows the public key can forge tokens with arbitrary authenticated claims.
Does exploiting this require an existing account or user interaction?
No. The supplied vector indicates network access with no privileges and no user interaction required, although exploitation has high attack complexity because the vulnerable key and algorithm-handling configuration must be present.
What version resolves the issue?
Upgrade PyJWT to version 2.14.0. The affected range is from 2.13.0 until 2.14.0.