pyjwt vulnerabilities

{
  "id": "ca392a9752afcb13ad42c2b230ca37f218c56eb8100b061beffa86ed3cdb3be1",
  "url": "https://osv.dev/vulnerability/USN-8916-2",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "pyjwt vulnerabilities",
    "summary": "USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the corresponding fix for PyJWT on Ubuntu 26.10. Original advisory details: YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. (CVE-2026-102266) Rohan Das discovered that PyJWT incorrectly handled redirects when fetching key sets. A remote attacker could possibly use this issue to cause PyJWT to disclose sensitive information. (CVE-2026-102267) It was discovered that PyJWT incorrectly recognized certain PEM representations. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102268) Nuno Lopes discovered that PyJWT incorrectly handled DER public keys when performing HMAC verification. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102271) It was discovered that PyJWT did not properly handle certain JWK keys prefixed with a byte-order mark. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102272) Charles Vosburgh discovered that PyJWT incorrectly handled certain JWK containers when performing HMAC verification. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102273)",
    "evidence": "osv:USN-8916-2",
    "products": [
      {
        "name": {
          "value": "pyjwt",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.13.0-1ubuntu1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "2.10.1-4ubuntu1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.12.1-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.13.0-1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "USN-8916-2",
      "aliases": [
        "USN-8916-2"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.13.0-1ubuntu1"
                }
              ]
            }
          ],
          "package": {
            "name": "pyjwt",
            "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=stonking",
            "ecosystem": "Ubuntu:26.10"
          },
          "versions": [
            "2.10.1-4ubuntu1",
            "2.12.1-1",
            "2.13.0-1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-2.json",
            "cves_map": {
              "cves": [
                {
                  "id": "CVE-2026-102266",
                  "severity": [
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                },
                {
                  "id": "CVE-2026-102267",
                  "severity": [
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                },
                {
                  "id": "CVE-2026-102268",
                  "severity": [
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                },
                {
                  "id": "CVE-2026-102271",
                  "severity": [
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                },
                {
                  "id": "CVE-2026-102272",
                  "severity": [
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                },
                {
                  "id": "CVE-2026-102273",
                  "severity": [
                    {
                      "type": "CVSS_V3",
                      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                }
              ],
              "ecosystem": "Ubuntu:26.10"
            }
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "python3-jwt",
                "binary_version": "2.13.0-1ubuntu1"
              }
            ],
            "availability": "No subscription required"
          }
        }
      ],
      "modified": "2026-10-27T11:56:51.258716356Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-102266",
        "CVE-2026-102267",
        "CVE-2026-102268",
        "CVE-2026-102271",
        "CVE-2026-102272",
        "CVE-2026-102273",
        "UBUNTU-CVE-2026-102266",
        "UBUNTU-CVE-2026-102267",
        "UBUNTU-CVE-2026-102268",
        "UBUNTU-CVE-2026-102271",
        "UBUNTU-CVE-2026-102272",
        "UBUNTU-CVE-2026-102273"
      ],
      "references": [
        "https://ubuntu.com/security/notices/USN-8916-2",
        "https://ubuntu.com/security/CVE-2026-102266",
        "https://ubuntu.com/security/CVE-2026-102267",
        "https://ubuntu.com/security/CVE-2026-102268",
        "https://ubuntu.com/security/CVE-2026-102271",
        "https://ubuntu.com/security/CVE-2026-102272",
        "https://ubuntu.com/security/CVE-2026-102273"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-102266",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-102267",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-102268",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-102271",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-102272",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-102273",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 461469,
  "published_at": "2026-10-15T06:24:37+00:00"
}