Improper Verification of Cryptographic Signature in pyjwt - #VU150528
Published: September 17, 2026
Vulnerability identifier: #VU150528
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge JWT claims.
The vulnerability exists due to improper verification of cryptographic signatures in PyJWT\'s HMAC key handling when verifying tokens with a public JWK container supplied as an HMAC key. A remote attacker can use known public key material to create forged HS256, HS384, or HS512 tokens to forge JWT claims.
Exploitation requires an application to allow both symmetric and asymmetric algorithms in the same verification path and use raw public JWK or JWKS JSON as the HMAC key.
Affected software
pyjwt
Remediation
Install security update from vendor's website.
pyjwt - update to 2.14.0