CVE-2026-102272

Katalog CVE

CVSS 7.4 · High EPSS 0,18%

Kerentanan Improper Verification of Cryptographic Signature pada pyjwt project pyjwt. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Rincian

Terbit di NVD

28 September 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947 exploit · mitigasi · advisory vendor
• https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291 patch
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 product · release notes