Patch Forecast
Amber warning
Patch this week.

CVE-2026-102272 · GHSA-r6x4-923q-g947

PyJWT BOM Bypass

Risk score
61/100
CVSS
7.4 v3.1
Exploit chance (30 days)
0.2%
Published
28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used …
Affected
PyJWT (pip) = 2.13.0
Fix
Upgrade PyJWT to 2.14.0 or later.
Exploitation
Public proof of concept

Story map

Story map: PyJWTTHE FLAWSTHE FIXCVE-2026-102272PyJWT BOM BypassCVSS 7.4 · EPSS 0%CVE-2026-102268Asymmetric-PEM detectionbypass:whitespace/line-ending-mutat…CVSS 9.1 · EPSS 0%CVE-2026-102266PyJWK accepts empty HMACkeys, bypassing PyJWT'sempty-key validationCVSS 9.1 · EPSS 0%CVE-2026-101917PyJWT: PyJWKClient stillamplifies unauthenticatedJWKS fetches on unknown kid…CVSS 7.5 · EPSS 0%Upgrade PyJWT2.14.0or later on your release lineWho is exposedPyJWT (pip) <= 2.13.0AMBER · PATCH THIS WEEKPyJWTPyJWT is a Pythonimplementation of JSON WebToken standards. Prior to 2.14.0,is_pem_format in jwt/utils.pyis affected becauseis_pem_format does notrecognize every PEM…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-347 (CWE-347)66 other warnings in 30 days →Same productEarlier PyJWT warnings10 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

PyJWT: Amber, patch this week. PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated pub…

The flaws

  • CVE-2026-102272: PyJWT BOM Bypass (CVSS 7.4 · EPSS 0%)
  • CVE-2026-102268: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard (CVSS 9.1 · EPSS 0%)
  • CVE-2026-102266: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation (CVSS 9.1 · EPSS 0%)
  • CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) (CVSS 7.5 · EPSS 0%)

The fix

Upgrade PyJWT: 2.14.0 or later on your release line

Who is exposed: PyJWT (pip) <= 2.13.0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 7.4 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
PyJWTpip= 2.13.02.14.0

References

Original description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Last activity 28 Sep 2026. Patch Forecast updates every hour.