Search: CVE-2026-102271

PyJWT versions from 2.4.0 up to but not including 2.14.0 contain a vulnerability in the HMACAlgorithm.prepare_key function. This flaw arises when applications mix HMAC and asymmetric algorithms and provide a DER-encoded public key as the shared verification key. Due to improper verification of cryptographic signatures, PyJWT mistakenly uses the public DER bytes as an HMAC secret. An attacker with knowledge of the public key can exploit this to forge authenticated HMAC tokens. The vulnerability is fixed in version 2.14.0.