CVE-2026-102271

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

• CWE-347

• https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102266PyJWT is a Python implementation of JSON Web Token standards…7.4
• CVE-2026-102267PyJWT is a Python implementation of JSON Web Token standards…7.4
• CVE-2026-102268PyJWT is a Python implementation of JSON Web Token standards…9.1
• CVE-2026-102269PyJWT is a Python implementation of JSON Web Token standards…4.8
• CVE-2026-10227A vulnerability has been found in raisulislamg4 student_mana…7.3
• CVE-2026-102270PyJWT is a Python implementation of JSON Web Token standards…4.4
• CVE-2026-102272PyJWT is a Python implementation of JSON Web Token standards…7.4
• CVE-2026-102273PyJWT is a Python implementation of JSON Web Token standards…7.4
• CVE-2026-102274PyJWT is a Python implementation of JSON Web Token standards…5.9
• CVE-2026-102275PyJWT is a Python implementation of JSON Web Token standards…6.5
• CVE-2026-102276The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-102277The brace-expansion library generates arbitrary strings cont…5.3