CVE-2026-102266

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102266
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102266.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102266
Aliases
Downstream
ALSA (2)
AZL (1)
BELL (1)
CGA (136)
CLEANSTART (4)
DEBIAN (1)
ECHO (1)
MINI (14)
openSUSE (1)
RLSA (2)
ROOT (1)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
Published
2026-09-28T20:21:26Z
Modified
2026-11-04T16:57:05Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Details

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102266.json"
}
References

Affected packages

Git / github.com/jpadilla/pyjwt

Affected ranges

Type
GIT
Repo
https://github.com/jpadilla/pyjwt
Events
Introduced
7144e4534c34810f4525dc4578a32addd8212cff
Fixed
c6fe464b356ff4b1ebc9ba62172d331a40aa27df
Fixed
f91ed44dd65baaf457f4b3353ed35e98a753934c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.13.0"
                },
                {
                    "fixed": "2.14.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "f91ed44dd65baaf457f4b3353ed35e98a753934c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "2.14.0",
            "range": [
                {
                    "fixed": "c6fe464b356ff4b1ebc9ba62172d331a40aa27df"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.13.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102266.json"