CVE-2026-102275

Katalog CVE

CVSS 8.2 · High EPSS 0,14%

Kerentanan Insufficient Verification of Data Authenticity pada pyjwt project pyjwt. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.

Rincian

Terbit di NVD

28 September 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-348: Use of Less Trusted Source

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449 exploit · advisory vendor
• https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c patch
• https://github.com/jpadilla/pyjwt/releases/tag/2.15.0 product · release notes