Skip to content
Heist/ feed
High

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Type: advisorySource: Official CVE ListRisk context updated1 source record

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

Announced Source revision 2
Original source ↗
CVE context updated. The publisher announcement is unchanged.

CVE-2026-102271

Primary source · Revision 2

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102271

pyjwt

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "jpadilla",
    "product": "pyjwt",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.4.0, < 2.14.0"
      }
    ]
  }
]
Related CVEs
CVE-2026-102271

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102271 · High

pyjwt

Event
#62544 · Revision 2
Added to Heist Feed
Publisher date
Read the original announcement