CVE-2026-102272

{
  "etk_id": "ETK-2026-18",
  "cve_id": "CVE-2026-102272",
  "display_id": "CVE-2026-102272",
  "ghsa_id": "GHSA-r6x4-923q-g947",
  "euvd_id": "EUVD-2026-88540",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Algorithm-confusion flaw in PyJWT token verification",
  "summary": "PyJWT 2.13.0 can mishandle encoded public JWK data and use it as HMAC key material during JWT verification. An attacker who knows the public key may forge tokens if the application supplies a raw RSA JWK and permits both HMAC and RSA algorithms.",
  "mitigation": "Upgrade PyJWT to 2.14.0. Until upgrading, restrict each verification path to its expected algorithm family and do not combine HMAC and asymmetric algorithms for the same raw public JWK key.",
  "vendor": "pip",
  "product": "pip:PyJWT",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "2.13.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.14.0"
      ],
      "package_name": "PyJWT",
      "purl": "pkg:pypi/PyJWT"
    }
  ],
  "cwes": [
    347
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0018,
  "epss_percentile": 0.0732,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.527347033333333,
  "t0_at": "2026-09-28T20:36:31.530000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-28T20:36:31.530000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T20:36:31.530000+00:00",
      "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"
    }
  }
}