---
id: CVE-2026-102269
title: PyJWT is a Python implementation of JSON Web Token standards
summary: >-
  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0,
  PyJWT signature segment is affected because signature segment decoding accepts
  characters outside the canonical Base64URL representation. This occurs when
  non…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-180
  - CWE-1286
vendor: pyjwt_project
product: pyjwt
affected:
  - pyjwt < 2.14.0
patched:
  - pyjwt 2.14.0
published: '2026-09-28'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T18:54:08.460'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102269'
references:
  - url: >-
      https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8
    label: security-advisories@github.com
  - url: 'https://github.com/jpadilla/pyjwt/releases/tag/2.14.0'
    label: security-advisories@github.com
  - url: 'https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102269.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-102269'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2542689'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102269'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102269'
  - url: 'https://github.com/advisories/GHSA-hxm8-2xgr-2p9m'
  - url: 'https://github.com/jpadilla/pyjwt'
  - url: 'https://pypi.org/project/pyjwt'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82415'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82368'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82061'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82059'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82371'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - ghsa
  - pip
  - osv
epss: 0.00224
epssPercentile: 0.131
aliases:
  - GHSA-hxm8-2xgr-2p9m
  - PYSEC-2026-4147
ecosystem: pip
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-29T13:48:45.838410Z'
ingestedAt: '2026-09-28T21:20:54.780Z'
---

## Overview

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.

## Affected

- `pyjwt < 2.14.0`

## Remediation

Upgrade past the affected range:

- `pyjwt 2.14.0`

## Package advisory (CVE-2026-102269)

Affected packages:

- `PyJWT <= 2.13.0`

Patched in:

- `PyJWT 2.14.0`

Source: https://github.com/advisories/GHSA-hxm8-2xgr-2p9m

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Ansible Automation Orchestrator 2026, Confidential Compute Attestation, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, … · no fix planned: Ansible Automation Orchestrator 2026, Confidential Compute Attestation, Fence Agents Remediation Operator, Lightspeed Core, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102269.json)
- **RHSA-2026:82415** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82415)
- **RHSA-2026:82368** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82368)
- **RHSA-2026:82061** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82061)
- **RHSA-2026:82059** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82059)
- **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371)