REDHAT-BUG-2542671: High severity pypi/pyjwt vulnerability

Q: What conditions are required for exploitation?

The trusted JWK Set must contain an oct (symmetric HMAC) key entry whose k value is empty. An attacker can then sign an HMAC token using the same zero-length key and have forged claims accepted through the affected PyJWK verification path.

Q: What is the impact if exploitation succeeds?

A successful attacker can create forged HMAC JWTs containing arbitrary claims that are treated as authenticated by the affected application.

Q: Which versions are affected and which version fixes the issue?

PyJWT versions from 2.13.0 up to, but not including, 2.14.0 are affected. The issue is fixed in PyJWT 2.14.0.

Q: How can I determine whether my deployment is exposed?

Check whether the application uses the PyJWK verification path with a trusted JWK Set and whether that set includes an oct entry with an empty k value. Also verify whether the installed PyJWT version is earlier than 2.14.0 but at least 2.13.0.

Published Sep 28, 2026

Updated

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Affected Software

1 affected component

pypi/pyjwt>=2.13.0<2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Sep 28, 2026

Data Sourced

via Red Hat·08:32 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

The trusted JWK Set must contain an oct (symmetric HMAC) key entry whose k value is empty. An attacker can then sign an HMAC token using the same zero-length key and have forged claims accepted through the affected PyJWK verification path.

What is the impact if exploitation succeeds?

A successful attacker can create forged HMAC JWTs containing arbitrary claims that are treated as authenticated by the affected application.

Which versions are affected and which version fixes the issue?

PyJWT versions from 2.13.0 up to, but not including, 2.14.0 are affected. The issue is fixed in PyJWT 2.14.0.

How can I determine whether my deployment is exposed?

Check whether the application uses the PyJWK verification path with a trusted JWK Set and whether that set includes an oct entry with an empty k value. Also verify whether the installed PyJWT version is earlier than 2.14.0 but at least 2.13.0.

REDHAT-BUG-2542671: High severity pypi/pyjwt vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the impact if exploitation succeeds?

Which versions are affected and which version fixes the issue?

How can I determine whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the impact if exploitation succeeds?

Which versions are affected and which version fixes the issue?

How can I determine whether my deployment is exposed?