CVE catalog

CVE-2026-102271

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absen

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpyjwtsid2.15.1-1fixed
Debianpyjwtforky2.15.1-1fixed
Debianpyjwttrixie2.10.1-2+deb13u1vulnerable
Debianpyjwttrixie-security2.10.1-2+deb13u1vulnerable
Debianpyjwtbookworm2.6.0-1+deb12u1vulnerable
Debianpyjwtbookworm-security2.6.0-1+deb12u1vulnerable
PyPIpyjwtNot reported2.14.0fixed
PyPIpyjwtNot reported2.14.0fixed
CpepyjwtNot reported2.14.0fixed
Ubuntupyjwtnoble2.7.0-1ubuntu0.3fixed
Ubuntupython3-jwtnoble2.7.0-1ubuntu0.3fixed
Susepython-PyJWTlinux micro 6.22.12.1-160000.3.1fixed
Ubuntupyjwtpro1.7.0-2vulnerable
Ubuntupyjwtpro1.7.1-1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm2vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm3fixed
Ubuntupyjwt22.041.7.1-2ubuntu2vulnerable
Ubuntupyjwt22.042.1.0-1vulnerable
Ubuntupyjwt22.042.3.0-1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.2vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.3vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.4vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.5fixed
Ubuntupyjwt24.042.7.0-1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.2vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.3fixed
Ubuntupyjwt26.102.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.102.12.1-1vulnerable
Ubuntupyjwt26.102.13.0-1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1fixed
Ubuntupyjwt26.042.10.1-2vulnerable
Ubuntupyjwt26.042.10.1-3vulnerable
Ubuntupyjwt26.042.10.1-3build1vulnerable
Ubuntupyjwt26.042.10.1-4vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpyjwtsourcesid2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourceforky2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianpyjwtsourcebookworm(unfixed)not yet assignedNot reportedNot reported
PyPIpyjwtPyPINot reported2.14.0Not reportedGHSA-P4G4-X82P-Q773Not reported
PyPIpyjwtPyPINot reported2.14.0Not reportedPYSEC-2026-4149Not reported
CpepyjwtcpeNot reported2.14.0Not reportedNVD-CVE-2026-102271Not reported
Ubuntupyjwtdebnoble2.7.0-1ubuntu0.3Not reportedNot reportedNot reported
Ubuntupython3-jwtdebnoble2.7.0-1ubuntu0.3Not reportedNot reportedNot reported
Susepython-PyJWTrpmlinux micro 6.22.12.1-160000.3.1Not reportedSUSE-SU-2026:24126-1Not reported
Ubuntupyjwtdebpro1.7.1-2ubuntu2.1+esm3Not reportedUBUNTU-CVE-2026-102271Not reported
Ubuntupyjwtdeb22.042.3.0-1ubuntu0.5Not reportedUBUNTU-CVE-2026-102271Not reported
Ubuntupyjwtdeb24.042.7.0-1ubuntu0.3Not reportedUBUNTU-CVE-2026-102271Not reported
Ubuntupyjwtdeb26.102.13.0-1ubuntu1Not reportedUBUNTU-CVE-2026-102271Not reported
Ubuntupyjwtdeb26.042.10.1-4ubuntu1.2Not reportedUBUNTU-CVE-2026-102271Not reported

Notes

[bookworm] pyjwt: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.6.0-1+deb12u1 · all · bookworm

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

[Debian 13 (Trixie)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

  • [python-jwt-doc]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]