Improper Verification of Cryptographic Signature in pyjwt - CVE-2026-102273
Published: September 17, 2026 / Updated: September 29, 2026
Vulnerability identifier: #VU150528
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102273
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge JWT claims.
The vulnerability exists due to improper verification of cryptographic signatures in PyJWT's HMAC key handling when verifying tokens with a public JWK container supplied as an HMAC key. A remote attacker can use known public key material to create forged HS256, HS384, or HS512 tokens to forge JWT claims.
Exploitation requires an application to allow both symmetric and asymmetric algorithms in the same verification path and use raw public JWK or JWKS JSON as the HMAC key.
Affected software
pyjwt
Ubuntu
python-jwt (Ubuntu package)
python3-jwt (Ubuntu package)
Ubuntu
python-jwt (Ubuntu package)
python3-jwt (Ubuntu package)
How to mitigate CVE-2026-102273
Install security update from vendor's website.
pyjwt - update to 2.14.0
python-jwt (Ubuntu package) - addressed in versions 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3
python3-jwt (Ubuntu package) - addressed in versions 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3, 2.10.1-4ubuntu1.2
python-jwt (Ubuntu package) - addressed in versions 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3
python3-jwt (Ubuntu package) - addressed in versions 1.3.0-1ubuntu0.1+esm3, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.1-2ubuntu2.1+esm3, 2.3.0-1ubuntu0.5, 2.7.0-1ubuntu0.3, 2.10.1-4ubuntu1.2