USN-8916-2

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8916-2
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-2.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8916-2
Upstream
CVE (6)
Published
2026-10-15T06:24:37Z
Modified
2026-10-19T17:13:37Z
Summary
pyjwt vulnerabilities
Details

USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the corresponding fix for PyJWT on Ubuntu 26.10.

Original advisory details:

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. (CVE-2026-102266)

Rohan Das discovered that PyJWT incorrectly handled redirects when fetching key sets. A remote attacker could possibly use this issue to cause PyJWT to disclose sensitive information. (CVE-2026-102267)

It was discovered that PyJWT incorrectly recognized certain PEM representations. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102268)

Nuno Lopes discovered that PyJWT incorrectly handled DER public keys when performing HMAC verification. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102271)

It was discovered that PyJWT did not properly handle certain JWK keys prefixed with a byte-order mark. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102272)

Charles Vosburgh discovered that PyJWT incorrectly handled certain JWK containers when performing HMAC verification. An attacker who knew the public key could possibly use this issue to forge authentication tokens. (CVE-2026-102273)

References

Affected packages

Ubuntu:26.10 / pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.13.0-1ubuntu1

Affected versions

2.*
2.10.1-4ubuntu1
2.12.1-1
2.13.0-1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "2.13.0-1ubuntu1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-2.json"