CVE-2026-102275
Fixed in a distro release EPSS <1%CVSS 6.5
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.
Products: jpadilla pyjwt
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyjwt | 2.15.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-jwt | 2.4.0-1.amzn2023.0.6 |
| Amazon Linux 2023 | python3-jwt+crypto | 2.4.0-1.amzn2023.0.6 |
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | awx | 24.6.1-r67 |
| Chainguard | datadog-agent-7.77-core-integrations | no fix |
| Chainguard | datadog-agent-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-7.80-core-integrations | no fix |
| Chainguard | datadog-agent-7.81-core-integrations | no fix |
| Chainguard | datadog-agent-7.82-core-integrations | no fix |
| Chainguard | datadog-agent-7.83-core-integrations | no fix |
| Chainguard | datadog-agent-7.84-core-integrations | 7.84.1-r1 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.79-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.80-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.81-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.82-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.83-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.84-core-integrations | 7.84.2-r3 |
| Chainguard | datahub-ingestion-fips | 1.7.0.1-r2 |
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | 0.21.0-r4 |
| Chainguard | lmcache-cuda-13.0 | 0.5.5-r1 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260928-r4 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260925-r4 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r18 |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r17 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260914-r7 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260914-r7 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260924-r7 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20261001-r4 |
| Chainguard | openstack-nova-2025.1 | 31.3.0_git20260717-r16 |
| Chainguard | openstack-nova-2025.2 | 32.2.0_git20260715-r17 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260916-r7 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260916-r7 |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260812-r12 |
| Chainguard | py3.12-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.12-airflow-postgres-fips-3 | 3.3.2-r5 |
| Chainguard | py3.13-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.13-airflow-postgres-fips-3 | 3.3.2-r5 |
| Chainguard | py3.14-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.14-airflow-postgres-fips-3 | 3.3.2-r5 |
| Chainguard | wazuh-manager-framework | 4.14.8-r5 |
| Chainguard | wazuh-manager-framework-fips | 4.14.8-r3 |
| Debian 12 | pyjwt | no fix |
| Debian 13 | pyjwt | no fix |
| Debian 14 | pyjwt | 2.15.0-1 |
| SUSE Linux Enterprise Server 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| SUSE Linux Micro 6.0 | python-PyJWT | 2.9.0-159998.1.1 |
| SUSE Linux Micro 6.2 | python-PyJWT | 2.12.1-160000.3.1 |
| Ubuntu 22.04 LTS | pyjwt | no fix |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.6 |
| Ubuntu 24.04 LTS | pyjwt | no fix |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.4 |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.3 |
| Ubuntu 26.04 LTS | pyjwt | no fix |
| Ubuntu 26.10 | pyjwt | 2.13.0-1ubuntu1.1 |
| Ubuntu 26.10 | pyjwt | no fix |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm4 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm4 |
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm4 |
| Wolfi | datadog-agent-7.77-core-integrations | no fix |
| Wolfi | datadog-agent-7.78-core-integrations | no fix |
| Wolfi | datadog-agent-7.80-core-integrations | no fix |
| Wolfi | datadog-agent-7.81-core-integrations | no fix |
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| openSUSE Tumbleweed | python-PyJWT | 2.15.1-1.1 |