{"id":"USN-8916-2","summary":"pyjwt vulnerabilities","details":"USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the\ncorresponding fix for PyJWT on Ubuntu 26.10.\n\nOriginal advisory details:\n\nYuSung Han discovered that PyJWT did not properly validate certain JWK keys\nwhen performing HMAC verification. An attacker could possibly use this\nissue to forge authentication tokens. (CVE-2026-102266)\n\nRohan Das discovered that PyJWT incorrectly handled redirects when fetching\nkey sets. A remote attacker could possibly use this issue to  cause PyJWT\nto disclose sensitive information. (CVE-2026-102267)\n\nIt was discovered that PyJWT incorrectly recognized certain PEM\nrepresentations. An attacker who knew the public key could possibly use\nthis issue to forge authentication tokens. (CVE-2026-102268)\n\nNuno Lopes discovered that PyJWT incorrectly handled DER public keys when\nperforming HMAC verification. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102271)\n\nIt was discovered that PyJWT did not properly handle certain JWK keys\nprefixed with a byte-order mark. An attacker who knew the public key could\npossibly use this issue to forge authentication tokens. (CVE-2026-102272)\n\nCharles Vosburgh discovered that PyJWT incorrectly handled certain JWK\ncontainers when performing HMAC verification. An attacker who knew the\npublic key could possibly use this issue to forge authentication tokens.\n(CVE-2026-102273)","modified":"2026-10-19T17:13:37.799751673Z","published":"2026-10-15T06:24:37Z","upstream":["CVE-2026-102266","CVE-2026-102267","CVE-2026-102268","CVE-2026-102271","CVE-2026-102272","CVE-2026-102273","UBUNTU-CVE-2026-102266","UBUNTU-CVE-2026-102267","UBUNTU-CVE-2026-102268","UBUNTU-CVE-2026-102271","UBUNTU-CVE-2026-102272","UBUNTU-CVE-2026-102273"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8916-2"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102266"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102267"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102268"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102271"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102272"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102273"}],"affected":[{"package":{"name":"pyjwt","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-1ubuntu1"}]}],"versions":["2.10.1-4ubuntu1","2.12.1-1","2.13.0-1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"python3-jwt","binary_version":"2.13.0-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8916-2.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:26.10"}}}],"schema_version":"1.9.0"}