PyJWT, a Python library for JSON Web Token implementation, prior to version 2.13.0, fails to properly validate the use of JSON Web Keys (JWK) in the HMAC algorithm while supporting both asymmetric and HMAC algorithms. This improper authentication validation allows an attacker to use the issuer's public key as the secret key for HMAC, enabling the forging of JWTs and potentially bypassing authentication. The vulnerability is identified as CWE-287 (Improper Authentication) and CWE-347 (Improper Verification of Cryptographic Signature). The issue is fixed in PyJWT version 2.13.0. Red Hat advisories confirm the vulnerability affects their products only if the specific non-standard verifier configuration is used.

An attacker can forge JSON Web Tokens by exploiting the improper validation of JWK in the HMAC algorithm, leading to authentication bypass and unauthorized access. This can compromise confidentiality and integrity of applications relying on PyJWT for JWT verification. The CVSS v3.1 score is 7.4 (High), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

A fixed version of PyJWT (2.13.0) is available and should be applied to remediate this vulnerability. Red Hat has released updates addressing this issue in their packages. Users should upgrade to PyJWT 2.13.0 or later. If using Red Hat products, apply the relevant security updates provided by Red Hat. Avoid using non-standard verifier configurations that accept both symmetric and asymmetric algorithms without proper validation.