REDHAT-BUG-2542695: High severity pypi/pyjwt vulnerability

Q: What configurations are exposed to this issue?

The issue affects mixed-algorithm verification paths where a public JWK prefixed with a UTF-8 byte-order mark is supplied. In that scenario, the public JWK can bypass asymmetric-key detection and be treated as an HMAC secret.

Q: What does an attacker need to exploit it?

An attacker needs to know the public key and be able to target a mixed-algorithm token verification path using a public JWK with a UTF-8 BOM prefix. This can allow the attacker to forge tokens that are accepted as authenticated.

Q: What version fixes the vulnerability?

The issue is fixed in PyJWT version 2.14.0. The affected range is stated as versions from 2.13.0 until 2.14.0.

Published Sep 28, 2026

Updated

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Affected Software

1 affected component

pypi/pyjwt>=2.13.0<2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Sep 28, 2026

Data Sourced

via Red Hat·08:52 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What configurations are exposed to this issue?

The issue affects mixed-algorithm verification paths where a public JWK prefixed with a UTF-8 byte-order mark is supplied. In that scenario, the public JWK can bypass asymmetric-key detection and be treated as an HMAC secret.

What does an attacker need to exploit it?

An attacker needs to know the public key and be able to target a mixed-algorithm token verification path using a public JWK with a UTF-8 BOM prefix. This can allow the attacker to forge tokens that are accepted as authenticated.

What version fixes the vulnerability?

The issue is fixed in PyJWT version 2.14.0. The affected range is stated as versions from 2.13.0 until 2.14.0.

REDHAT-BUG-2542695: High severity pypi/pyjwt vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What configurations are exposed to this issue?

What does an attacker need to exploit it?

What version fixes the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What configurations are exposed to this issue?

What does an attacker need to exploit it?

What version fixes the vulnerability?