Vulnerability-Lookup

OPENSUSE-SU-2026:11994-1

Vulnerability from csaf_opensuse - Published: 2026-10-04 00:00 - Updated: 2026-10-05 09:18

Summary

python313-PyJWT-2.15.1-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: python313-PyJWT-2.15.1-1.1 on GA media

Description of the patch: These are all security issues fixed in the python313-PyJWT-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11994

CVE-2026-101917

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-101918

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact moderate

CVE-2026-102266

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact important

CVE-2026-102268

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact important

CVE-2026-102269

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact moderate

CVE-2026-102270

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact moderate

CVE-2026-102272

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact important

CVE-2026-102275

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact moderate

CVE-2026-103001

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2026-101917

Threats

Impact moderate

References

29 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-101917/	self
https://www.suse.com/security/cve/CVE-2026-101918/	self
https://www.suse.com/security/cve/CVE-2026-102266/	self
https://www.suse.com/security/cve/CVE-2026-102268/	self
https://www.suse.com/security/cve/CVE-2026-102269/	self
https://www.suse.com/security/cve/CVE-2026-102270/	self
https://www.suse.com/security/cve/CVE-2026-102272/	self
https://www.suse.com/security/cve/CVE-2026-102275/	self
https://www.suse.com/security/cve/CVE-2026-103001/	self
https://www.suse.com/security/cve/CVE-2026-101917	external
https://bugzilla.suse.com/1283060	external
https://www.suse.com/security/cve/CVE-2026-101918	external
https://bugzilla.suse.com/1283061	external
https://www.suse.com/security/cve/CVE-2026-102266	external
https://bugzilla.suse.com/1283063	external
https://www.suse.com/security/cve/CVE-2026-102268	external
https://bugzilla.suse.com/1283065	external
https://www.suse.com/security/cve/CVE-2026-102269	external
https://bugzilla.suse.com/1283066	external
https://www.suse.com/security/cve/CVE-2026-102270	external
https://bugzilla.suse.com/1283067	external
https://www.suse.com/security/cve/CVE-2026-102272	external
https://bugzilla.suse.com/1283069	external
https://www.suse.com/security/cve/CVE-2026-102275	external
https://bugzilla.suse.com/1283072	external
https://www.suse.com/security/cve/CVE-2026-103001	external
https://bugzilla.suse.com/1283829	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-PyJWT-2.15.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-PyJWT-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11994",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11994-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-101917 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-101917/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-101918 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-101918/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102266 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102266/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102268 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102268/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102269 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102269/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102270 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102270/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102272 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102272/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102275 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-103001 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-103001/"
      }
    ],
    "title": "python313-PyJWT-2.15.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-05T09:18:38Z",
      "generator": {
        "date": "2026-10-04T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11994-1",
      "initial_release_date": "2026-10-04T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-04T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-05T09:18:38Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-PyJWT-0:2.15.1-1.1.aarch64",
                "product": {
                  "name": "python313-PyJWT-0:2.15.1-1.1.aarch64",
                  "product_id": "python313-PyJWT-0:2.15.1-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:pyjwt_project:pyjwt:2.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-PyJWT@2.15.1-1.1?arch=aarch64\u0026upstream=python-PyJWT-0:2.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-PyJWT-0:2.15.1-1.1.aarch64",
                "product": {
                  "name": "python314-PyJWT-0:2.15.1-1.1.aarch64",
                  "product_id": "python314-PyJWT-0:2.15.1-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-PyJWT@2.15.1-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-PyJWT-0:2.15.1-1.1.ppc64le",
                "product": {
                  "name": "python313-PyJWT-0:2.15.1-1.1.ppc64le",
                  "product_id": "python313-PyJWT-0:2.15.1-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:pyjwt_project:pyjwt:2.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-PyJWT@2.15.1-1.1?arch=ppc64le\u0026upstream=python-PyJWT-0:2.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-PyJWT-0:2.15.1-1.1.ppc64le",
                "product": {
                  "name": "python314-PyJWT-0:2.15.1-1.1.ppc64le",
                  "product_id": "python314-PyJWT-0:2.15.1-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-PyJWT@2.15.1-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-PyJWT-0:2.15.1-1.1.s390x",
                "product": {
                  "name": "python313-PyJWT-0:2.15.1-1.1.s390x",
                  "product_id": "python313-PyJWT-0:2.15.1-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:pyjwt_project:pyjwt:2.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-PyJWT@2.15.1-1.1?arch=s390x\u0026upstream=python-PyJWT-0:2.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-PyJWT-0:2.15.1-1.1.s390x",
                "product": {
                  "name": "python314-PyJWT-0:2.15.1-1.1.s390x",
                  "product_id": "python314-PyJWT-0:2.15.1-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-PyJWT@2.15.1-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-PyJWT-0:2.15.1-1.1.x86_64",
                "product": {
                  "name": "python313-PyJWT-0:2.15.1-1.1.x86_64",
                  "product_id": "python313-PyJWT-0:2.15.1-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:pyjwt_project:pyjwt:2.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-PyJWT@2.15.1-1.1?arch=x86_64\u0026upstream=python-PyJWT-0:2.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-PyJWT-0:2.15.1-1.1.x86_64",
                "product": {
                  "name": "python314-PyJWT-0:2.15.1-1.1.x86_64",
                  "product_id": "python314-PyJWT-0:2.15.1-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-PyJWT@2.15.1-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-PyJWT-0:2.15.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64"
        },
        "product_reference": "python313-PyJWT-0:2.15.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-PyJWT-0:2.15.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le"
        },
        "product_reference": "python313-PyJWT-0:2.15.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-PyJWT-0:2.15.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x"
        },
        "product_reference": "python313-PyJWT-0:2.15.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-PyJWT-0:2.15.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64"
        },
        "product_reference": "python313-PyJWT-0:2.15.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-PyJWT-0:2.15.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64"
        },
        "product_reference": "python314-PyJWT-0:2.15.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-PyJWT-0:2.15.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le"
        },
        "product_reference": "python314-PyJWT-0:2.15.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-PyJWT-0:2.15.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x"
        },
        "product_reference": "python314-PyJWT-0:2.15.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-PyJWT-0:2.15.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        },
        "product_reference": "python314-PyJWT-0:2.15.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-101917",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-101917"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-101917",
          "url": "https://www.suse.com/security/cve/CVE-2026-101917"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283060 for CVE-2026-101917",
          "url": "https://bugzilla.suse.com/1283060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-101917"
    },
    {
      "cve": "CVE-2026-101918",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-101918"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-101918",
          "url": "https://www.suse.com/security/cve/CVE-2026-101918"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283061 for CVE-2026-101918",
          "url": "https://bugzilla.suse.com/1283061"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-101918"
    },
    {
      "cve": "CVE-2026-102266",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102266"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102266",
          "url": "https://www.suse.com/security/cve/CVE-2026-102266"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283063 for CVE-2026-102266",
          "url": "https://bugzilla.suse.com/1283063"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-102266"
    },
    {
      "cve": "CVE-2026-102268",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102268"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102268",
          "url": "https://www.suse.com/security/cve/CVE-2026-102268"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283065 for CVE-2026-102268",
          "url": "https://bugzilla.suse.com/1283065"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-102268"
    },
    {
      "cve": "CVE-2026-102269",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102269"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102269",
          "url": "https://www.suse.com/security/cve/CVE-2026-102269"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283066 for CVE-2026-102269",
          "url": "https://bugzilla.suse.com/1283066"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-102269"
    },
    {
      "cve": "CVE-2026-102270",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102270"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102270",
          "url": "https://www.suse.com/security/cve/CVE-2026-102270"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283067 for CVE-2026-102270",
          "url": "https://bugzilla.suse.com/1283067"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-102270"
    },
    {
      "cve": "CVE-2026-102272",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102272"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102272",
          "url": "https://www.suse.com/security/cve/CVE-2026-102272"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283069 for CVE-2026-102272",
          "url": "https://bugzilla.suse.com/1283069"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-102272"
    },
    {
      "cve": "CVE-2026-102275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102275",
          "url": "https://www.suse.com/security/cve/CVE-2026-102275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283072 for CVE-2026-102275",
          "url": "https://bugzilla.suse.com/1283072"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-102275"
    },
    {
      "cve": "CVE-2026-103001",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-103001"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT\u0027s PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-103001",
          "url": "https://www.suse.com/security/cve/CVE-2026-103001"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283829 for CVE-2026-103001",
          "url": "https://bugzilla.suse.com/1283829"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-PyJWT-0:2.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-PyJWT-0:2.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-103001"
    }
  ]
}

CVE-2026-101917 (GCVE-0-2026-101917)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:07 – Updated: 2026-09-28 20:35

Title

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 20:35 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/ba4853a7…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: < 2.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101917",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T20:35:19.525335Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T20:35:25.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:07:44.237Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2gx3-rcp4-g85q",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101917",
    "datePublished": "2026-09-28T20:07:44.237Z",
    "dateReserved": "2026-09-28T15:55:37.908Z",
    "dateUpdated": "2026-09-28T20:35:25.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101918 (GCVE-0-2026-101918)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:11 – Updated: 2026-09-29 13:57

Title

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Summary

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 13:55 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/5fde08a6…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.15.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: >= 2.0.0a1, < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101918",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T13:55:59.459735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T13:57:29.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0a1, \u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:11:55.278Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-42vr-xj54-vc7v",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101918",
    "datePublished": "2026-09-28T20:11:55.278Z",
    "dateReserved": "2026-09-28T15:55:37.908Z",
    "dateUpdated": "2026-09-29T13:57:29.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102266 (GCVE-0-2026-102266)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:21 – Updated: 2026-09-29 19:35

Title

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Summary

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 19:28 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/f91ed44d…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: >= 2.13.0, < 2.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102266",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T19:28:36.086597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T19:35:42.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:21:26.164Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9j54-fg26-wv3r",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWK accepts empty HMAC keys, bypassing PyJWT\u0027s empty-key validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102266",
    "datePublished": "2026-09-28T20:21:26.164Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T19:35:42.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102268 (GCVE-0-2026-102268)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:26 – Updated: 2026-09-29 13:59

Title

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Summary

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 13:59 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/8b4e233a…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: < 2.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102268",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T13:59:05.202281Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T13:59:11.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:26:13.674Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-ffc3-869f-jxw9",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102268",
    "datePublished": "2026-09-28T20:26:13.674Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T13:59:11.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102269 (GCVE-0-2026-102269)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:27 – Updated: 2026-09-29 13:49

Title

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 13:48 UTC

CWE

CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/e6f48401…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: < 2.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102269",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T13:48:45.838410Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T13:49:47.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:27:54.521Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hxm8-2xgr-2p9m",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT: Non-canonical signature segments enable raw-token revocation bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102269",
    "datePublished": "2026-09-28T20:27:54.521Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T13:49:47.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102270 (GCVE-0-2026-102270)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:29 – Updated: 2026-09-29 19:36

Title

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 19:36 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/8b4e233a…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: < 2.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102270",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T19:36:18.803784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T19:36:54.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:29:24.479Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jwrc-g2q2-pq5p",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT: ReDoS vulnerability when calling the `is_pem_format` function."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102270",
    "datePublished": "2026-09-28T20:29:24.479Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T19:36:54.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102272 (GCVE-0-2026-102272)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:36 – Updated: 2026-09-29 14:45

Title

PyJWT BOM Bypass

Summary

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 14:45 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/18078393…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: >= 2.13.0, < 2.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102272",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T14:45:38.333972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T14:45:44.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:36:31.530Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r6x4-923q-g947",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT BOM Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102272",
    "datePublished": "2026-09-28T20:36:31.530Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T14:45:44.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102275 (GCVE-0-2026-102275)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:46 – Updated: 2026-09-29 13:56

Title

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 13:56 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity
CWE-348 - Use of Less Trusted Source

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/3cd9ceec…	x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.15.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: >= 2.1.0, < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102275",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T13:56:03.446684Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T13:56:09.869Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "CWE-348: Use of Less Trusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:46:33.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x33g-cr3x-6449",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102275",
    "datePublished": "2026-09-28T20:46:33.169Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T13:56:09.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103001 (GCVE-0-2026-103001)

Vulnerability from cvelistv5 – Published: 2026-09-30 21:15 – Updated: 2026-09-30 21:17

Title

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-471 - Modification of Assumed-Immutable Data (MAID)

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/jpadilla/pyjwt/security/adviso…	x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/issues/679	x_refsource_MISC
https://github.com/jpadilla/pyjwt/commit/0c87c8c8…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jpadilla	pyjwt	Affected: >= 2.11.0, <= 2.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pyjwt",
          "vendor": "jpadilla",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.11.0, \u003c= 2.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT\u0027s PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-471",
              "description": "CWE-471: Modification of Assumed-Immutable Data (MAID)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T21:17:58.116Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/issues/679",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/issues/679"
        },
        {
          "name": "https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35"
        }
      ],
      "source": {
        "advisory": "GHSA-gvp8-978c-rx2q",
        "discovery": "UNKNOWN"
      },
      "title": "PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-103001",
    "datePublished": "2026-09-30T21:15:12.862Z",
    "dateReserved": "2026-09-29T20:46:08.335Z",
    "dateUpdated": "2026-09-30T21:17:58.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11994-1

CVE-2026-101917 (GCVE-0-2026-101917)

CVE-2026-101918 (GCVE-0-2026-101918)

CVE-2026-102266 (GCVE-0-2026-102266)

CVE-2026-102268 (GCVE-0-2026-102268)

CVE-2026-102269 (GCVE-0-2026-102269)

CVE-2026-102270 (GCVE-0-2026-102270)

CVE-2026-102272 (GCVE-0-2026-102272)

CVE-2026-102275 (GCVE-0-2026-102275)

CVE-2026-103001 (GCVE-0-2026-103001)

Tags

Sightings

Nomenclature

Related by attack behaviour