PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

The vulnerability arises because the PyJWT library's HMACAlgorithm.from_jwk method does not reject empty keys in symmetric (kty=oct) JWKs, returning a zero-length key. When verifying JWTs using such keys via PyJWK, PyJWKSet, or PyJWKClient, the library computes HMAC with an empty key and accepts any token forged with this empty key. This bypasses signature verification without requiring secret knowledge. The string/bytes secret verification path was fixed in version 2.13.0 to reject empty keys, but the JWK/JWKS verification path remains vulnerable. The vulnerability is exploitable if the JWKS contains an oct key with an empty 'k' value, which can result from misconfiguration such as unset environment variables or fallback mechanisms. The issue is tracked as CWE-347 (Improper Verification of Cryptographic Signature).

An unauthenticated attacker who can send tokens to an application verifying JWTs using PyJWT with a JWK/JWKS containing an empty HMAC key can forge tokens with arbitrary claims. This compromises the integrity and authenticity of JWT-based authentication or authorization, potentially allowing privilege escalation or unauthorized access. The vulnerability does not affect the string/bytes secret verification path in PyJWT 2.13.0 and later, only the JWK/JWKS path. There are no known exploits in the wild at this time.

A patch is available that addresses this vulnerability by rejecting empty HMAC keys in the JWK/JWKS verification path. Users should upgrade PyJWT to a version later than 2.13.0 where this issue is fixed. Until patched, ensure that JWKS used for verification do not contain oct keys with empty 'k' values, and verify configuration to avoid unset or empty secrets being published in JWKS. The default decode options emit a warning but do not fail verification, so relying on warnings is insufficient mitigation.