PyJWT: Token forgery via empty HMAC key in JWK/JWKS (GHSA-pxh4-856f-4h89)

PyJWT versions up to 2.13.0 contain a vulnerability where HMACAlgorithm.from_jwk fails to reject empty symmetric keys (kty=oct with k=""). An attacker can forge JWTs signed with an empty HMAC key and bypass authentication if the target application resolves its signing keys from a JWK or JWKS source that publishes an empty key - a scenario typically triggered by an unset environment variable in the authentication service. This defect mirrors previously patched vulnerabilities in other JWT libraries and exposes an asymmetric verification gap compared to the existing hardened string-secret API.

Attack Chain

1. An authentication service is misconfigured (e.g., SIGNING_SECRET is unset), resulting in a published JWKS containing an oct-type key with an empty k value.
2. The target application uses PyJWKClient to resolve signing keys from the published JWKS.
3. An attacker crafts a JWT with arbitrary claims (e.g., role:admin) and selects the target JWK via the kid header.
4. The attacker signs the forged token locally using an empty byte string as the HMAC key.
5. The attacker sends the forged token in the Authorization header to the target application.
6. The target application fetches the empty-key JWK, which PyJWKClient processes into a zero-length key.
7. The application invokes jwt.decode using the zero-length key, which HMACAlgorithm accepts, verifying the forged signature and granting the attacker unauthorized access.

Impact

Successful exploitation allows unauthenticated attackers to achieve full impersonation and privilege escalation by minting tokens with arbitrary claims. This affects any application using PyJWK, PyJWKSet, or PyJWKClient for key resolution.

Recommendation

1. Upgrade PyJWT to a version containing the fix for GHSA-pxh4-856f-4h89.
2. Audit authentication provider configurations to ensure that signing secrets are correctly populated and not defaulting to empty strings.
3. Validate that published JWKS endpoints do not contain entries with empty k values.
4. If an immediate upgrade is not possible, implement a validation layer in the application to reject PyJWK objects resolved with empty keys before passing them to jwt.decode.