PyJWT versions prior to 0.22.4 contain a vulnerability where empty HMAC keys supplied via oct JWKs are accepted during HS256 token verification, bypassing the library's empty-key validation. This allows an attacker to forge valid HS256 JWTs if the application uses an empty symmetric JWK key, potentially leading to unauthorized token acceptance.