Skip to content
Threat Feed
Subscribe

Product

PyJWT (<= 2.13.0)

1 brief RSS
critical advisory

PyJWT Asymmetric-PEM Detection Bypass Leading to Algorithm Confusion

An incomplete asymmetric-key guard in PyJWT (CVE-2026-102268) allows specially formatted public keys to be used as HMAC secrets, enabling universal token forgery when applications misconfigure algorithm allow-lists.

PyJWT +1 jwt authentication-bypass cve-2026-102268 library-vulnerability
1t 2c