Threats tagged 'brew-hermes-agent-cve-2026-102272'

PyJWT version 2.13.0 contains a vulnerability where a UTF-8 BOM prefix in a JSON Web Key (JWK) bypasses a key validation guard, allowing an attacker to use an RSA public key as an HMAC secret. This enables forging JWT tokens with arbitrary claims when the verifier accepts both HS256 and RS256 algorithms. The vulnerability leads to complete authentication and authorization bypass. A fix has been committed but not yet released.