PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

• CVE-2026-102268: 0.24% estimated exploitation activity in the next 30 days; percentile 14.65 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Prerequisites (both conditions must hold; both are deployment properties, not attacker-controlled at request time): - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms=["ES256", "HS256"] (the RFC 8725 footgun the guard exists to backstop). - The verification key is passed as raw PEM text/bytes on the non-PyJWK path, in a byte-form that cryptography's loader accepts but PyJWT's ispemformat regex does not recognize (marker-adjacent whitespace/indentation, CR-only line terminators, or the PEM folded to a single line). Such forms arise naturally from an indented YAML/JSON block, a single-line environment variable or JSON string, or a CR/LF round-trip through config tooling. The attacker additionally needs the public verification key, which is public by definition, and cryptography must be installed. The fix for CVE-2022-29217 rejects an asymmetric key handed to an HMAC algorithm, but only when ispemformat() recognizes the key as PEM. That…

Published by the source

29 Sep 2026, 23:17 UTC

Last modified by the source

1 Oct 2026, 17:55 UTC

Source last checked

26 Oct 2026, 13:54 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-ffc3-869f-jxw9

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-ffc3-869f-jxw9

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-ffc3-869f-jxw9

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-102268

Advisory: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
IDs: CVE-2026-102268, GHSA-ffc3-869f-jxw9
Record: https://patchnext.com/advisories/cve-2026-102268 (revision 3, source checked 26 Oct 2026, 13:54 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: pyjwt 2.14.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI pyjwt: affected <= 2.13.0; fixed in 2.14.0

## Suggested inspection (read-only)
- `python -m pip show pyjwt`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pyjwt.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-ffc3-869f-jxw9 (GitHub-reviewed advisory GHSA-ffc3-869f-jxw9 lists affected ranges: PyPI pyjwt >=0 <=2.13.0)
- Verified: https://osv.dev/vulnerability/GHSA-ffc3-869f-jxw9 (OSV record GHSA-ffc3-869f-jxw9 lists affected ranges: PyPI pyjwt >=0 <2.14.0 (fixed))

Commands are suggestions: review each one before running it.