CVE-2026-102268 json
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
published 2026-09-28 41 d ago modified 2026-10-07 32 d ago also GHSA-ffc3-869f-jxw9 , PYSEC-2026-4145 , EUVD-2026-88535
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
Patch / fix
- pypi pyjwt 2.14.0
- pyjwt_project pyjwt 2.14.0
- pyjwt Debian 14 2.14.0-1
debian advisories DEBIAN-CVE-2026-102268
- pyjwt Ubuntu 22.04 LTS 2.3.0-1ubuntu0.5
- pyjwt Ubuntu 24.04 LTS 2.7.0-1ubuntu0.3
- pyjwt Ubuntu 26.10 2.13.0-1ubuntu1
- pyjwt Ubuntu 26.04 LTS 2.10.1-4ubuntu1.2
- pyjwt Ubuntu Pro 18.04 LTS 1.5.3+ds1-1ubuntu0.1+esm3
- pyjwt Ubuntu Pro 20.04 LTS 1.7.1-2ubuntu2.1+esm3
ubuntu advisories UBUNTU-CVE-2026-102268
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-PyJWT SLE Module for Public Cloud 12 1.5.3-3.22.1
- python-PyJWT SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 2.8.0-150400.8.20.1
- python-PyJWT Linux Micro 6.1 2.12.1-slfo.1.1_3.1
- python-PyJWT SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.12.1-160000.3.1
- python-PyJWT Linux Micro 6.0 2.9.0-159998.1.1
suse advisories SUSE-SU-2026:5093-1SUSE-SU-2026:5064-1SUSE-SU-2026:24377-1SUSE-SU-2026:24126-1SUSE-SU-2026:24219-1SUSE-SU-2026:24134-1
- python-PyJWT openSUSE Leap 16.0 2.12.1-160000.3.1
- python-PyJWT openSUSE Tumbleweed 2.15.1-1.1
opensuse advisories openSUSE-SU-2026:22074-1openSUSE-SU-2026:11994-1
- fence-virt AlmaLinux 9 4.10.0-110.el9_8.8
- fence-agents-all AlmaLinux 9 4.10.0-110.el9_8.8
- fence-agents-apc AlmaLinux 9 4.10.0-110.el9_8.8
- fence-agents-aws AlmaLinux 9 4.10.0-110.el9_8.8
- fence-agents-gce AlmaLinux 9 4.10.0-110.el9_8.8
- fence-agents-rsa AlmaLinux 9 4.10.0-110.el9_8.8
- ha-cloud-support AlmaLinux 9 4.10.0-110.el9_8.8
- fence-agents-lpar AlmaLinux 9 4.10.0-110.el9_8.8
almalinux advisories ALSA-2026:94500ALSA-2026:94501
- fence-agents Rocky Linux 10 4.16.0-21.el10_2.7
- fence-agents Rocky Linux 9 4.10.0-110.el9_8.8
rocky linux advisories RLSA-2026:94501RLSA-2026:94500
- python-jwt Azure Linux 3.0 2.15.1-1
azure linux advisories AZL-104991
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-102268 updated cvss 9.1
pyjwt: PyJWT: Authentication bypass via improper public key validation
-
Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/ee-supported-rhel8, ansible-automation-platform-24/ee-supported-rhel9, ansible-automation-platform-25/ee-supported-rhel8, ansible-automation-platform-25/ee-supported-rhel9affected: workaround, no fix available
-
Red Hat Ceph Storage 4 python2-jwt Red Hat Ceph Storage 7 rhceph/rhceph-7-rhel9 Red Hat Ceph Storage 9 rhceph/rhceph-9-rhel9affected: workaround, no fix available “Fix deferred”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9 Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9 Red Hat Satellite 6 python-pyjwt, python3-pyjwt, python3.12-pyjwt Red Hat Update Infrastructure 5 rhui5/rhua-rhel9affected: workaround, no fix available
-
Red Hat AI Inference Server 3.5 rhaii/vllm-cpu-rhel9 1791473614, rhaii/vllm-cuda-rhel9 1791473631, rhaii/vllm-rocm-rhel9 1791425869, rhaii/vllm-gaudi-rhel9 1791427182, rhaii/vllm-spyre-rhel9 1791818357fixed: vendor fix RHSA-2026:82415
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1791947385, ansible-automation-platform-26/gateway-rhel9 1791971533, ansible-automation-platform-26/ee-supported-rhel9 1791974220fixed: vendor fix RHSA-2026:87120
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1792388670, ansible-automation-platform-27/gateway-rhel9 1792429216fixed: vendor fix RHSA-2026:87124
-
Red Hat Enterprise Linux AI 3.5 rhelai3/bootc-cuda-rhel9 1793135861, rhelai3/bootc-rocm-rhel9 1793135863, rhelai3/bootc-aws-cuda-rhel9 1793194817, rhelai3/bootc-gcp-cuda-rhel9 1793194815, rhelai3/disk-image-cuda-rhel9 1793206758, rhelai3/bootc-azure-cuda-rhel9 1793194815, +1 morefixed: vendor fix RHSA-2026:92452
-
Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-110.el9_8.8, fence-virtd 4.10.0-110.el9_8.8, fence-agents 4.10.0-110.el9_8.8, fence-virtd-cpg 4.10.0-110.el9_8.8, fence-virtd-tcp 4.10.0-110.el9_8.8, fence-agents-all 4.10.0-110.el9_8.8, +51 morefixed: vendor fix RHSA-2026:94500
show 16 moreshow fewer
-
Red Hat Enterprise Linux AppStream (v. 10) fence-virt 4.16.0-21.el10_2.7, fence-virtd 4.16.0-21.el10_2.7, fence-agents 4.16.0-21.el10_2.7, fence-virtd-cpg 4.16.0-21.el10_2.7, fence-virtd-tcp 4.16.0-21.el10_2.7, fence-agents-all 4.16.0-21.el10_2.7, +50 morefixed: vendor fix RHSA-2026:94501
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-virt 4.10.0-43.el9_2.27, fence-virtd 4.10.0-43.el9_2.27, fence-agents 4.10.0-43.el9_2.27, fence-virtd-cpg 4.10.0-43.el9_2.27, fence-virtd-tcp 4.10.0-43.el9_2.27, fence-agents-virsh 4.10.0-43.el9_2.27, +8 morefixed: vendor fix RHSA-2026:94634
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) fence-virt 4.10.0-62.el9_4.31, fence-virtd 4.10.0-62.el9_4.31, fence-agents 4.10.0-62.el9_4.31, fence-virtd-cpg 4.10.0-62.el9_4.31, fence-virtd-tcp 4.10.0-62.el9_4.31, fence-agents-virsh 4.10.0-62.el9_4.31, +8 morefixed: vendor fix RHSA-2026:94557
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-virt 4.16.0-5.el10_0.14, fence-virtd 4.16.0-5.el10_0.14, fence-agents 4.16.0-5.el10_0.14, fence-virtd-cpg 4.16.0-5.el10_0.14, fence-virtd-tcp 4.16.0-5.el10_0.14, fence-agents-all 4.16.0-5.el10_0.14, +50 morefixed: vendor fix RHSA-2026:95012
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-virt 4.10.0-86.el9_6.23, fence-virtd 4.10.0-86.el9_6.23, fence-agents 4.10.0-86.el9_6.23, fence-virtd-cpg 4.10.0-86.el9_6.23, fence-virtd-tcp 4.10.0-86.el9_6.23, fence-agents-all 4.10.0-86.el9_6.23, +51 morefixed: vendor fix RHSA-2026:94523
-
Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-all 4.10.0-43.el9_2.27, fence-agents-apc 4.10.0-43.el9_2.27, fence-agents-aws 4.10.0-43.el9_2.27, fence-agents-eps 4.10.0-43.el9_2.27, fence-agents-gce 4.10.0-43.el9_2.27, fence-agents-rsa 4.10.0-43.el9_2.27, +37 morefixed: vendor fix RHSA-2026:94634
-
Red Hat Enterprise Linux High Availability E4S (v.9.4) fence-agents-all 4.10.0-62.el9_4.31, fence-agents-apc 4.10.0-62.el9_4.31, fence-agents-aws 4.10.0-62.el9_4.31, fence-agents-eps 4.10.0-62.el9_4.31, fence-agents-gce 4.10.0-62.el9_4.31, fence-agents-rsa 4.10.0-62.el9_4.31, +37 morefixed: vendor fix RHSA-2026:94557
-
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-all 4.10.0-43.el9_2.27, fence-agents-apc 4.10.0-43.el9_2.27, fence-agents-aws 4.10.0-43.el9_2.27, fence-agents-eps 4.10.0-43.el9_2.27, fence-agents-gce 4.10.0-43.el9_2.27, fence-agents-rsa 4.10.0-43.el9_2.27, +36 morefixed: vendor fix RHSA-2026:94634
-
Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) fence-agents-all 4.10.0-62.el9_4.31, fence-agents-apc 4.10.0-62.el9_4.31, fence-agents-aws 4.10.0-62.el9_4.31, fence-agents-eps 4.10.0-62.el9_4.31, fence-agents-gce 4.10.0-62.el9_4.31, fence-agents-rsa 4.10.0-62.el9_4.31, +36 morefixed: vendor fix RHSA-2026:94557
-
Red Hat Satellite 6.18 satellite/foreman-mcp-server-rhel9 1793272276, satellite/iop-host-inventory-rhel9 1793248583fixed: vendor fix RHSA-2026:92667
-
Red Hat Satellite 6.19 satellite/foreman-mcp-server-rhel9 1793272279, satellite/iop-host-inventory-rhel9 1793248689fixed: vendor fix RHSA-2026:92666
-
Red Hat Trusted Artifact Signer 1.4 rhtas/model-transparency-rhel9 1792402739fixed: vendor fix RHSA-2026:84785
-
Red Hat Trusted Artifact Signer 1.5 rhtas/rh-sigstore-a2a-rhel9 1793624122, rhtas/model-transparency-rhel9 1793696578fixed: vendor fix RHSA-2026:95261
-
Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-backend-rhel9 Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-podvm-builder-rhel9 Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel9-operator Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9, openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9, rhaii/vllm-neuron-rhel9not affected: vulnerable code not present
-
Red Hat Ansible Automation Platform 2 python-pyjwt, python3x-pyjwt, python3.11-pyjwt, python3.12-pyjwt, automation-controller, ansible-automation-platform-24/hub-rhel8, +23 morenot affected: vulnerable code not in execute path
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-web-rhel9 1791952205, ansible-automation-platform-26/receptor-rhel9 1791968536, ansible-automation-platform-26/mcp-tools-rhel9 1791941340, ansible-automation-platform-26/controller-rhel9 1791947602, ansible-automation-platform-26/de-minimal-rhel9 1791961810, ansible-automation-platform-26/ee-minimal-rhel9 1791893966, +22 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-web-rhel9 1792394496, ansible-automation-platform-27/receptor-rhel9 1792139928, ansible-automation-platform-27/mcp-tools-rhel9 1792425046, ansible-automation-platform-27/controller-rhel9 1792389457, ansible-automation-platform-27/de-minimal-rhel9 1792141111, ansible-automation-platform-27/ee-minimal-rhel9 1792388184, +25 more Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux command line assistant rhel-cla/rhel-knowledge-bridge-rhel10 Red Hat OpenShift AI (RHOAI) rhoai/odh-ogx-core-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, +22 more Red Hat OpenShift Container Platform 4 openshift4/ose-ansible-operatornot affected: vulnerable code not present
8 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 40 d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyjwt | <2.14.0 |
2.14.0 |
Affected products
- jpadilla pyjwt
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
-
github.com
/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07
web, patch
-
github.com
/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9
exploit, web, vendor-advisory
-
github.com
/jpadilla/pyjwt/releases/tag/2.14.0
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-102268
advisory
-
github.com
/jpadilla/pyjwt
package
-
pypi.org
/project/pyjwt
package
-
github.com
/advisories/GHSA-ffc3-869f-jxw9
advisory
Sources
- CVE List CVE-2026-102268
- GitHub Advisory GHSA-ffc3-869f-jxw9
- NVD CVE-2026-102268
- OSV PYSEC-2026-4145
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.