Search: CVE-2026-102266

CVE-2026-102266 is a vulnerability in PyJWT 2.13.0 where verification of HS256 tokens using an empty symmetric octet JWK key bypasses the intended empty key rejection. While raw empty HMAC keys are rejected, empty keys supplied via PyJWK objects are accepted, allowing attackers to forge valid HS256 JWTs if the application uses an empty key in its JWK set. This occurs because the PyJWK verification path does not invoke the empty key validation, enabling signature verification with a zero-length key.