--- id: CVE-2026-102273 title: PyJWT is a Python implementation of JSON Web Token standards summary: >- PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. T… severity: high cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-347 vendor: pyjwt_project product: pyjwt affected: - pyjwt = 2.13.0 patched: - PyJWT 2.14.0 published: '2026-09-28' updated: '2026-10-06' sourceUpdated: '2026-10-06T18:29:42.883' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102273' references: - url: >- https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95 label: security-advisories@github.com - url: 'https://github.com/jpadilla/pyjwt/releases/tag/2.14.0' label: security-advisories@github.com - url: 'https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w' label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102273.json - url: 'https://access.redhat.com/security/cve/CVE-2026-102273' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2542697' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102273' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102273' - url: 'https://github.com/advisories/GHSA-w2cx-738m-mc7w' - url: 'https://github.com/jpadilla/pyjwt' - url: 'https://pypi.org/project/pyjwt' - url: 'https://access.redhat.com/errata/RHSA-2026:79378' - url: 'https://access.redhat.com/errata/RHSA-2026:82415' - url: 'https://access.redhat.com/errata/RHSA-2026:82368' - url: 'https://access.redhat.com/errata/RHSA-2026:82061' - url: 'https://access.redhat.com/errata/RHSA-2026:82059' - url: 'https://access.redhat.com/errata/RHSA-2026:82371' - url: 'https://access.redhat.com/errata/RHSA-2026:83112' - url: 'https://access.redhat.com/errata/RHSA-2026:83120' - url: 'https://access.redhat.com/errata/RHSA-2026:83121' - url: 'https://access.redhat.com/errata/RHSA-2026:83114' - url: 'https://access.redhat.com/errata/RHSA-2026:84734' tags: - nvd - cve.org - csaf - vex - red-hat - ghsa - pip - osv epss: 0.00175 epssPercentile: 0.069 aliases: - GHSA-w2cx-738m-mc7w - PYSEC-2026-4151 ecosystem: pip ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-09-29T13:39:56.542639Z' ingestedAt: '2026-09-28T21:20:54.782Z' --- ## Overview PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0. ## Affected - `pyjwt = 2.13.0` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-102273) Affected packages: - `PyJWT = 2.13.0` Patched in: - `PyJWT 2.14.0` Source: https://github.com/advisories/GHSA-w2cx-738m-mc7w ## Vendor advisories - **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, … · no fix planned: Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Ansible Automation Orchestrator 2026, Fence Agents Remediation Operator, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102273.json) - **RHSA-2026:79378** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79378) - **RHSA-2026:82415** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82415) - **RHSA-2026:82368** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82368) - **RHSA-2026:82061** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82061) - **RHSA-2026:82059** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82059) - **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371) - **RHSA-2026:83112** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83112) - **RHSA-2026:83120** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83120) - **RHSA-2026:83121** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83121) - **RHSA-2026:83114** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83114) - **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)