PyJWT version 2.13.0 has a vulnerability involving algorithm confusion where public JWK containers can be incorrectly accepted as HMAC secrets. This allows an attacker who knows the public key material to forge HS256/HS384/HS512 JWT tokens if the application mixes symmetric and asymmetric algorithms and uses raw public JWK/JWKS JSON as the HMAC secret. The issue is fixed in PyJWT 2.14.0.