SB2026101638 - openEuler 22.03 LTS SP4 update for python-jwt

Description

This security bulletin contains information about 3 vulnerabilities.

1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-102267)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive request headers and cause forged JWT acceptance.

The vulnerability exists due to improper validation of redirect destinations in PyJWKClient when fetching JWKS from an attacker-influenced configured endpoint. A remote attacker can cause the endpoint to return a redirect to a different host to disclose sensitive request headers and cause forged JWT acceptance.

A token kid alone does not trigger the issue.

2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-102268)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to forge arbitrary-claim tokens.

The vulnerability exists due to improper verification of cryptographic signatures in HMACAlgorithm.prepare_key and is_pem_format when processing a loader-accepted PEM public key that is not recognized as PEM under a mixed algorithm allow-list. A remote attacker can sign an HS256 token using the public key as an HMAC secret to forge arbitrary-claim tokens.

Exploitation requires knowledge of the public verification key, cryptography to be installed, and use of the raw PEM non-PyJWK verification path.

3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-102271)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to forge authentication tokens with arbitrary claims.

The vulnerability exists due to improper verification of cryptographic signatures in HMACAlgorithm.prepare_key when verifying tokens with DER-form asymmetric public keys while HMAC and asymmetric algorithms are enabled. A remote attacker can submit a forged HMAC-signed token to forge authentication tokens with arbitrary claims.

The issue does not affect PyJWK or PyJWKClient verification paths.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4386