Search: CVE-2026-102269

PyJWT versions prior to 2.14.0 accept JWS signature segments with non-canonical Base64URL characters, which do not affect the decoded signature or claims but alter the serialized token and its hash. This can allow bypass of logout or revocation mechanisms that rely on the raw serialized token as a security identity. The issue is not related to signature forgery and requires possession of a valid token. A fix rejecting such non-canonical characters is prepared but not yet released.