{"id":"USN-8916-1","summary":"pyjwt vulnerabilities","details":"YuSung Han discovered that PyJWT did not properly validate certain JWK keys\nwhen performing HMAC verification. An attacker could possibly use this\nissue to forge authentication tokens. This issue only affected  Ubuntu\n26.04 LTS. (CVE-2026-102266)\n\nRohan Das discovered that PyJWT incorrectly handled redirects when fetching\nkey sets. A remote attacker could possibly use this issue to  cause PyJWT\nto disclose sensitive information. This issue only affected Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS. (CVE-2026-102267)\n\nIt was discovered that PyJWT incorrectly recognized certain PEM\nrepresentations. An attacker who knew the public key could possibly use\nthis issue to forge authentication tokens. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu\n26.04 LTS. (CVE-2026-102268)\n\nNuno Lopes discovered that PyJWT incorrectly handled DER public keys when\nperforming HMAC verification. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102271)\n\nIt was discovered that PyJWT did not properly handle certain JWK keys\nprefixed with a byte-order mark. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102272)\n\nCharles Vosburgh discovered that PyJWT incorrectly handled certain JWK\ncontainers when performing HMAC verification. An attacker who knew the\npublic key could possibly use this issue to forge authentication tokens.\n(CVE-2026-102273)","modified":"2026-10-14T11:57:59.087988824Z","published":"2026-10-13T10:09:47Z","upstream":["CVE-2026-102266","CVE-2026-102267","CVE-2026-102268","CVE-2026-102271","CVE-2026-102272","CVE-2026-102273","UBUNTU-CVE-2026-102266","UBUNTU-CVE-2026-102267","UBUNTU-CVE-2026-102268","UBUNTU-CVE-2026-102271","UBUNTU-CVE-2026-102272","UBUNTU-CVE-2026-102273"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8916-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102266"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102267"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102268"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102271"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102272"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102273"}],"affected":[{"package":{"name":"pyjwt","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1+esm3"}]}],"versions":["1.0.0-0ubuntu1","1.3.0-1","1.3.0-1ubuntu0.1","1.3.0-1ubuntu0.1+esm1","1.3.0-1ubuntu0.1+esm2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.3.0-1ubuntu0.1+esm3","binary_name":"python-jwt"},{"binary_name":"python3-jwt","binary_version":"1.3.0-1ubuntu0.1+esm3"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-1.json"}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+ds1-1ubuntu0.1+esm3"}]}],"versions":["1.4.2-1.1","1.5.3+ds1-1","1.5.3+ds1-1ubuntu0.1","1.5.3+ds1-1ubuntu0.1+esm1","1.5.3+ds1-1ubuntu0.1+esm2"],"ecosystem_specific":{"binaries":[{"binary_name":"python-jwt","binary_version":"1.5.3+ds1-1ubuntu0.1+esm3"},{"binary_name":"python3-jwt","binary_version":"1.5.3+ds1-1ubuntu0.1+esm3"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[]}}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2ubuntu2.1+esm3"}]}],"versions":["1.7.0-2","1.7.1-1","1.7.1-2ubuntu1","1.7.1-2ubuntu2","1.7.1-2ubuntu2.1","1.7.1-2ubuntu2.1+esm1","1.7.1-2ubuntu2.1+esm2"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_name":"python3-jwt","binary_version":"1.7.1-2ubuntu2.1+esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[]}}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu0.5"}]}],"versions":["1.7.1-2ubuntu2","2.1.0-1","2.3.0-1","2.3.0-1ubuntu0.1","2.3.0-1ubuntu0.2","2.3.0-1ubuntu0.3","2.3.0-1ubuntu0.4"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-jwt","binary_version":"2.3.0-1ubuntu0.5"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-1.json"}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1ubuntu0.3"}]}],"versions":["2.7.0-1","2.7.0-1ubuntu0.1","2.7.0-1ubuntu0.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"python3-jwt","binary_version":"2.7.0-1ubuntu0.3"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:24.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-1.json"}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-4ubuntu1.2"}]}],"versions":["2.10.1-2","2.10.1-3","2.10.1-3build1","2.10.1-4","2.10.1-4ubuntu1","2.10.1-4ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.10.1-4ubuntu1.2","binary_name":"python3-jwt"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:26.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-1.json"}}],"schema_version":"1.9.0"}