CVE-2026-102266
Fixed in a distro release EPSS <1%CVSS 7.4
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.
Products: jpadilla pyjwt
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyjwt | 2.14.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-jwt | 2.4.0-1.amzn2023.0.6 |
| Amazon Linux 2023 | python3-jwt+crypto | 2.4.0-1.amzn2023.0.6 |
| Chainguard | authentik-2026.5 | 2026.5.7-r4 |
| Chainguard | authentik-fips-2026.5 | 2026.5.7-r7 |
| Chainguard | azureml-inference-server-http | no fix |
| Chainguard | azureml-inference-server-http-fips | no fix |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r26 |
| Chainguard | datadog-agent-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-7.79-core-integrations | 7.79.2-r20 |
| Chainguard | datadog-agent-7.80-core-integrations | 7.80.4-r19 |
| Chainguard | datadog-agent-7.81-core-integrations | 7.81.3-r8 |
| Chainguard | datadog-agent-7.82-core-integrations | 7.82.3-r5 |
| Chainguard | datadog-agent-7.83-core-integrations | 7.83.3-r2 |
| Chainguard | datadog-agent-7.84-core-integrations | 7.84.1-r1 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | 7.77.3-r38 |
| Chainguard | datadog-agent-fips-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.79-core-integrations | 7.79.2-r18 |
| Chainguard | datadog-agent-fips-7.80-core-integrations | 7.80.4-r21 |
| Chainguard | datadog-agent-fips-7.81-core-integrations | 7.81.3-r12 |
| Chainguard | datadog-agent-fips-7.82-core-integrations | 7.82.3-r8 |
| Chainguard | datadog-agent-fips-7.83-core-integrations | 7.83.3-r3 |
| Chainguard | datadog-agent-fips-7.84-core-integrations | 7.84.2-r3 |
| Chainguard | datahub-ingestion | 1.7.0.1-r2 |
| Chainguard | datahub-ingestion-fips | 1.7.0.1-r1 |
| Chainguard | ggshield | 1.55.0-r1 |
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | 0.21.0-r4 |
| Chainguard | kserve-storage-controller | 0.21.0-r1 |
| Chainguard | litellm | 1.103.1-r1 |
| Chainguard | mcp-atlassian | 0.23.1-r2 |
| Chainguard | metaflow-service-fips | 2.6.1-r1 |
| Chainguard | nemo-rl-cuda-13.0-gym | 0.7.0-r2 |
| Chainguard | nemo-rl-cuda-13.0-vllm | 0.7.0-r2 |
| Chainguard | netbox-fips | 4.7.2-r1 |
| Chainguard | open-webui | 0.11.4-r1 |
| Chainguard | openstack-cinder-2026.1 | 28.0.0_git20260904-r4 |
| Chainguard | openstack-designate-2025.2 | 21.0.1_git20260817-r2 |
| Chainguard | openstack-designate-2026.1 | 22.0.1_git20260827-r2 |
| Chainguard | openstack-glance-2025.1 | 30.2.0_git20260912-r2 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260928-r1 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260925-r1 |
| Chainguard | openstack-glance-2026.1-fips | 32.0.0_git20260930-r1 |
| Chainguard | openstack-heat-2025.2 | 25.0.1_git20260905-r1 |
| Chainguard | openstack-heat-2026.1 | 26.0.1_git20260905-r1 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r13 |
| Chainguard | openstack-horizon-2025.1 | no fix |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r12 |
| Chainguard | openstack-horizon-2025.2 | no fix |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260914-r3 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260914-r2 |
| Chainguard | openstack-horizon-2026.1 | no fix |
| Chainguard | openstack-horizon-2026.1-fips | no fix |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260910-r4 |
| Chainguard | openstack-keystone-2025.2 | no fix |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260902-r4 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260904-r8 |
| Chainguard | openstack-manila-2025.2 | 21.0.2_git20260923-r1 |
| Chainguard | openstack-manila-2026.1 | 22.0.1_git20260905-r1 |
| Chainguard | openstack-neutron-2026.1 | 28.0.2_git20260928-r3 |
| Chainguard | openstack-nova-2025.1 | 31.3.0_git20260717-r13 |
| Chainguard | openstack-nova-2025.2 | 32.2.0_git20260715-r14 |
| Chainguard | openstack-nova-2025.2 | no fix |
| Chainguard | openstack-nova-2026.1 | no fix |
| Chainguard | openstack-octavia-2025.2 | 17.0.1_git20260904-r1 |
| Chainguard | openstack-octavia-2026.1 | 18.0.1_git20260904-r1 |
| Chainguard | openstack-placement-2025.1 | 13.0.0_git20260916-r4 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260916-r4 |
| Chainguard | openstack-placement-2025.2 | 14.0.0_git20260916-r5 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260916-r4 |
| Chainguard | openstack-placement-2026.1 | no fix |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260812-r9 |
| Chainguard | py3-cassandra-medusa | 0.30.1-r1 |
| Chainguard | py3.12-airflow-core-3 | 3.3.2-r2 |
| Chainguard | py3.12-airflow-postgres-fips-3 | 3.3.2-r1 |
| Chainguard | py3.13-airflow-core-3 | 3.3.2-r2 |
| Chainguard | py3.13-airflow-postgres-fips-3 | 3.3.2-r1 |
| Chainguard | py3.14-airflow-core-3 | 3.3.2-r2 |
| Chainguard | py3.14-airflow-postgres-fips-3 | 3.3.2-r1 |
| Chainguard | semgrep | 1.178.0-r6 |
| Chainguard | superset-5.0 | 5.0.0-r36 |
| Chainguard | superset-6.1 | 6.1.0-r10 |
| Chainguard | superset-fips-6.1 | 6.1.0-r7 |
| Debian 13 | pyjwt | no fix |
| Debian 14 | pyjwt | 2.14.0-1 |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.5 |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.3 |
| Ubuntu 26.04 LTS | pyjwt | no fix |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.2 |
| Ubuntu 26.10 | pyjwt | no fix |
| Ubuntu 26.10 | pyjwt | 2.13.0-1ubuntu1 |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm3 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm3 |
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm3 |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r26 |
| Wolfi | datadog-agent-7.78-core-integrations | no fix |
| Wolfi | datadog-agent-7.79-core-integrations | 7.79.2-r20 |
| Wolfi | datadog-agent-7.80-core-integrations | 7.80.4-r19 |
| Wolfi | datadog-agent-7.81-core-integrations | 7.81.3-r8 |
| Wolfi | ggshield | 1.55.0-r1 |
| Wolfi | kserve-storage-controller | 0.21.0-r1 |
| Wolfi | open-webui | 0.11.4-r1 |
| Wolfi | py3-cassandra-medusa | 0.30.1-r1 |
| Wolfi | semgrep | 1.178.0-r6 |
| Wolfi | superset-6.1 | 6.1.0-r10 |
| openSUSE Tumbleweed | python-PyJWT | 2.15.1-1.1 |