AZL-105221

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105221.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-105221

Upstream

CVE-2026-102271

Published

2026-09-28T21:17:15Z

Modified

2026-10-02T05:34:59Z

Summary

CVE-2026-102271 affecting package python-jwt 2.13.0-1

Details

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102271

Affected packages

Azure Linux:3 / python-jwt

Package

Name: python-jwt
Purl: pkg:rpm/azure-linux/python-jwt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.13.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105221.json"