CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
Attackers can forge HMAC tokens by bypassing asymmetric key detection in PyJWT when applications mix HMAC and asymmetric algorithms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102268?
CVE-2026-102268 is a critical vulnerability in jpadilla pyjwt, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
Weakness: CWE-347
Which versions are affected by CVE-2026-102268?
3 open source packages ship an affected version, including pyjwt and PyJWT. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyjwt PyPI | All versions | 2.14.0 |
pyjwt PyPI | All versions | 2.14.0 |
PyJWT PyPI | All versions | 2.14.0 |
Products include Pyjwt Project Pyjwt.
How do I fix CVE-2026-102268?
Upgrade pyjwt to 2.14.0 or later.
Is CVE-2026-102268 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102268 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in jpadilla pyjwt
- CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
- CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS
- CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
- CVE-2026-102272 PyJWT BOM Bypass
Sources
Also known as AZL-104991, CLEANSTART-2026-SE75887, CLEANSTART-2026-YD28238, DEBIAN-CVE-2026-102268, ECHO-e77a-93cd-76e1, GHSA-ffc3-869f-jxw9 and 28 more.