SUSE-SU-2026:5093-1: Security update for python-PyJWT

Q: What conditions allow token forgery?

An attacker must know the public key to forge authenticated HMAC tokens. Systems that use python-PyJWT for HMAC token authentication and expose or otherwise make the public key available are the relevant concern.

Q: What is the operational impact of the CPU-consumption issue?

An attacker can cause intensive CPU consumption. This can affect availability of services that process attacker-supplied tokens using the affected package.

Q: Which SUSE packages are covered by this update?

The update covers suse/python-pyjwt and suse/python3-pyjwt, including python-PyJWT in the SUSE Public Cloud Module 12 (noarch).

Q: When was this security update published?

SUSE-SU-2026:5093-1 was published on 2026-11-04 and is rated high severity.

Published Nov 4, 2026

Updated

This update for python-PyJWT fixes the following issues:

- CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).

Other sources

This update for python-PyJWT fixes the following issues: CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).

— SUSE

Affected Software

4 affected componentsFixes available

suse/python-pyjwt<1.5.3-3.22.1

1.5.3-3.22.1

All of the following

SUSE Public Cloud Module 12 (noarch)

Any of the following

suse/python3-pyjwt<1.5.3-3.22.1

1.5.3-3.22.1

suse/python-pyjwt<1.5.3-3.22.1

1.5.3-3.22.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/python-PyJWT to a version that resolves this vulnerability.
Fixed in 1.5.3-3.22.1
Upgrade
Upgrade suse/python3-PyJWT to a version that resolves this vulnerability.
Fixed in 1.5.3-3.22.1
Upgrade
Upgrade python-PyJWT to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Public-Cloud-12-2026-5093

Event History

Nov 4, 2026

Advisory Published

via OSV·08:16 AM

Data Sourced

via OSV·08:16 AM

DescriptionAffected Software

Advisory Published

via SUSE·08:16 AM

Data Sourced

via SUSE·08:16 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What conditions allow token forgery?

An attacker must know the public key to forge authenticated HMAC tokens. Systems that use python-PyJWT for HMAC token authentication and expose or otherwise make the public key available are the relevant concern.

What is the operational impact of the CPU-consumption issue?

An attacker can cause intensive CPU consumption. This can affect availability of services that process attacker-supplied tokens using the affected package.

Which SUSE packages are covered by this update?

The update covers suse/python-pyjwt and suse/python3-pyjwt, including python-PyJWT in the SUSE Public Cloud Module 12 (noarch).

When was this security update published?

SUSE-SU-2026:5093-1 was published on 2026-11-04 and is rated high severity.

SUSE-SU-2026:5093-1: Security update for python-PyJWT

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions allow token forgery?

What is the operational impact of the CPU-consumption issue?

Which SUSE packages are covered by this update?

When was this security update published?

Company

Resources

Contact

Frequently Asked Questions

What conditions allow token forgery?

What is the operational impact of the CPU-consumption issue?

Which SUSE packages are covered by this update?

When was this security update published?