CVE catalog

CVE-2026-102268

Severity: Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Sep 28, 2026, 8:23:33 PM UTC
Updated: Sep 28, 2026, 9:17:14 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.24% · Oct 27, 2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pyjwt	sid	`2.15.1-1`	fixed
Debian	pyjwt	forky	`2.15.1-1`	fixed
Debian	pyjwt	trixie	`2.10.1-2+deb13u1`	vulnerable
Debian	pyjwt	trixie-security	`2.10.1-2+deb13u1`	vulnerable
Debian	pyjwt	bookworm	`2.6.0-1+deb12u1`	vulnerable
Debian	pyjwt	bookworm-security	`2.6.0-1+deb12u1`	vulnerable
PyPI	pyjwt	Not reported	`2.14.0`	fixed
PyPI	pyjwt	Not reported	`2.14.0`	fixed
Cpe	pyjwt	Not reported	`2.14.0`	fixed
Ubuntu	pyjwt	noble	`2.7.0-1ubuntu0.3`	fixed
Ubuntu	python3-jwt	noble	`2.7.0-1ubuntu0.3`	fixed
Ubuntu:Pro:16.04:LTS	pyjwt	Not reported	`1.0.0-0ubuntu1`	vulnerable
Ubuntu:Pro:16.04:LTS	pyjwt	Not reported	`1.3.0-1`	vulnerable
Ubuntu:Pro:16.04:LTS	pyjwt	Not reported	`1.3.0-1ubuntu0.1`	vulnerable
Ubuntu:Pro:16.04:LTS	pyjwt	Not reported	`1.3.0-1ubuntu0.1+esm1`	vulnerable
Ubuntu:Pro:16.04:LTS	pyjwt	Not reported	`1.3.0-1ubuntu0.1+esm2`	vulnerable
Ubuntu:Pro:16.04:LTS	pyjwt	Not reported	`1.3.0-1ubuntu0.1+esm3`	fixed
Ubuntu:Pro:18.04:LTS	pyjwt	Not reported	`1.4.2-1.1`	vulnerable
Ubuntu:Pro:18.04:LTS	pyjwt	Not reported	`1.5.3+ds1-1`	vulnerable
Ubuntu:Pro:18.04:LTS	pyjwt	Not reported	`1.5.3+ds1-1ubuntu0.1`	vulnerable
Ubuntu:Pro:18.04:LTS	pyjwt	Not reported	`1.5.3+ds1-1ubuntu0.1+esm1`	vulnerable
Ubuntu:Pro:18.04:LTS	pyjwt	Not reported	`1.5.3+ds1-1ubuntu0.1+esm2`	vulnerable
Ubuntu:Pro:18.04:LTS	pyjwt	Not reported	`1.5.3+ds1-1ubuntu0.1+esm3`	fixed
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.0-2`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-1`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu1`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu2`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu2.1`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu2.1+esm1`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu2.1+esm2`	vulnerable
Ubuntu:Pro:20.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu2.1+esm3`	fixed
Ubuntu:22.04:LTS	pyjwt	Not reported	`1.7.1-2ubuntu2`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.1.0-1`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.3.0-1`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.3.0-1ubuntu0.1`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.3.0-1ubuntu0.2`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.3.0-1ubuntu0.3`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.3.0-1ubuntu0.4`	vulnerable
Ubuntu:22.04:LTS	pyjwt	Not reported	`2.3.0-1ubuntu0.5`	fixed
Ubuntu:24.04:LTS	pyjwt	Not reported	`2.7.0-1`	vulnerable
Ubuntu:24.04:LTS	pyjwt	Not reported	`2.7.0-1ubuntu0.1`	vulnerable
Ubuntu:24.04:LTS	pyjwt	Not reported	`2.7.0-1ubuntu0.2`	vulnerable
Ubuntu:24.04:LTS	pyjwt	Not reported	`2.7.0-1ubuntu0.3`	fixed
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-2`	vulnerable
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-3`	vulnerable
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-3build1`	vulnerable
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-4`	vulnerable
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-4ubuntu1`	vulnerable
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-4ubuntu1.1`	vulnerable
Ubuntu:26.04:LTS	pyjwt	Not reported	`2.10.1-4ubuntu1.2`	fixed
Ubuntu	pyjwt	pro	`1.7.0-2`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-1`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-2ubuntu1`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-2ubuntu2`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-2ubuntu2.1`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-2ubuntu2.1+esm1`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-2ubuntu2.1+esm2`	vulnerable
Ubuntu	pyjwt	pro	`1.7.1-2ubuntu2.1+esm3`	fixed
Ubuntu	pyjwt	22.04	`1.7.1-2ubuntu2`	vulnerable
Ubuntu	pyjwt	22.04	`2.1.0-1`	vulnerable
Ubuntu	pyjwt	22.04	`2.3.0-1`	vulnerable
Ubuntu	pyjwt	22.04	`2.3.0-1ubuntu0.1`	vulnerable
Ubuntu	pyjwt	22.04	`2.3.0-1ubuntu0.2`	vulnerable
Ubuntu	pyjwt	22.04	`2.3.0-1ubuntu0.3`	vulnerable
Ubuntu	pyjwt	22.04	`2.3.0-1ubuntu0.4`	vulnerable
Ubuntu	pyjwt	22.04	`2.3.0-1ubuntu0.5`	fixed
Ubuntu	pyjwt	24.04	`2.7.0-1`	vulnerable
Ubuntu	pyjwt	24.04	`2.7.0-1ubuntu0.1`	vulnerable
Ubuntu	pyjwt	24.04	`2.7.0-1ubuntu0.2`	vulnerable
Ubuntu	pyjwt	24.04	`2.7.0-1ubuntu0.3`	fixed
Ubuntu	pyjwt	26.10	`2.10.1-4ubuntu1`	vulnerable
Ubuntu	pyjwt	26.10	`2.12.1-1`	vulnerable
Ubuntu	pyjwt	26.10	`2.13.0-1`	vulnerable
Ubuntu	pyjwt	26.10	`2.13.0-1ubuntu1`	fixed
Ubuntu	pyjwt	26.04	`2.10.1-2`	vulnerable
Ubuntu	pyjwt	26.04	`2.10.1-3`	vulnerable
Ubuntu	pyjwt	26.04	`2.10.1-3build1`	vulnerable
Ubuntu	pyjwt	26.04	`2.10.1-4`	vulnerable
Ubuntu	pyjwt	26.04	`2.10.1-4ubuntu1`	vulnerable
Ubuntu	pyjwt	26.04	`2.10.1-4ubuntu1.1`	vulnerable
Ubuntu	pyjwt	26.04	`2.10.1-4ubuntu1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pyjwt	source	sid	`2.14.0-1`	not yet assigned	Not reported	Not reported
Debian	pyjwt	source	forky	`2.14.0-1`	not yet assigned	Not reported	Not reported
Debian	pyjwt	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	pyjwt	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
PyPI	pyjwt	PyPI	Not reported	`2.14.0`	Not reported	GHSA-FFC3-869F-JXW9	Not reported
PyPI	pyjwt	PyPI	Not reported	`2.14.0`	Not reported	PYSEC-2026-4145	Not reported
Cpe	pyjwt	cpe	Not reported	`2.14.0`	Not reported	NVD-CVE-2026-102268	Not reported
Ubuntu	pyjwt	deb	noble	`2.7.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	python3-jwt	deb	noble	`2.7.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu:Pro:16.04:LTS	pyjwt	Ubuntu:Pro:16.04:LTS	Not reported	`1.3.0-1ubuntu0.1+esm3`	Not reported	USN-8916-1	Not reported
Ubuntu:Pro:18.04:LTS	pyjwt	Ubuntu:Pro:18.04:LTS	Not reported	`1.5.3+ds1-1ubuntu0.1+esm3`	Not reported	USN-8916-1	Not reported
Ubuntu:Pro:20.04:LTS	pyjwt	Ubuntu:Pro:20.04:LTS	Not reported	`1.7.1-2ubuntu2.1+esm3`	Not reported	USN-8916-1	Not reported
Ubuntu:22.04:LTS	pyjwt	Ubuntu:22.04:LTS	Not reported	`2.3.0-1ubuntu0.5`	Not reported	USN-8916-1	Not reported
Ubuntu:24.04:LTS	pyjwt	Ubuntu:24.04:LTS	Not reported	`2.7.0-1ubuntu0.3`	Not reported	USN-8916-1	Not reported
Ubuntu:26.04:LTS	pyjwt	Ubuntu:26.04:LTS	Not reported	`2.10.1-4ubuntu1.2`	Not reported	USN-8916-1	Not reported
Ubuntu	pyjwt	deb	pro	`1.7.1-2ubuntu2.1+esm3`	Not reported	UBUNTU-CVE-2026-102268	Not reported
Ubuntu	pyjwt	deb	22.04	`2.3.0-1ubuntu0.5`	Not reported	UBUNTU-CVE-2026-102268	Not reported
Ubuntu	pyjwt	deb	24.04	`2.7.0-1ubuntu0.3`	Not reported	UBUNTU-CVE-2026-102268	Not reported
Ubuntu	pyjwt	deb	26.10	`2.13.0-1ubuntu1`	Not reported	UBUNTU-CVE-2026-102268	Not reported
Ubuntu	pyjwt	deb	26.04	`2.10.1-4ubuntu1.2`	Not reported	UBUNTU-CVE-2026-102268	Not reported

Notes

[bookworm] pyjwt: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-jwt]Affected
Source package: [pyjwt]
Details (4)
- 2.6.0-1+deb12u1 · all · bookworm
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt · debian · bookworm; nvd · pyjwt; nvd · pyjwt · debian · 12
- 2.6.0-1+deb12u1 · all · bookworm
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt · debian · bookworm; nvd · pyjwt; nvd · pyjwt · debian · 12
- 2.6.0-1+deb12u1 · all · bookworm-security
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt · debian · bookworm; nvd · pyjwt; nvd · pyjwt · debian · 12
- 2.6.0-1+deb12u1 · all · bookworm-security
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt · debian · bookworm; nvd · pyjwt; nvd · pyjwt · debian · 12

[Debian 13 (Trixie)]

[python3-jwt]Affected
Source package: [pyjwt]
Details (4)
- 2.10.1-2+deb13u1 · all · trixie
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
- 2.10.1-2+deb13u1 · all · trixie
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
- 2.10.1-2+deb13u1 · all · trixie-security
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
- 2.10.1-2+deb13u1 · all · trixie-security
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
[python-jwt-doc]Affected
Source package: [pyjwt]
Details (4)
- 2.10.1-2+deb13u1 · all · trixie
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
- 2.10.1-2+deb13u1 · all · trixie
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
- 2.10.1-2+deb13u1 · all · trixie-security
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13
- 2.10.1-2+deb13u1 · all · trixie-security
  Affected · Fixed: 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.10.1-4ubuntu1.2, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3
  nvd · pyjwt; nvd · pyjwt · debian · 13

Observed: Oct 27, 2026, 12:22:02 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]