Threats tagged 'brew-hermes-agent-cve-2026-102275'

PyJWT versions from 2.1.0+ (Ed25519) and 2.2.0+ (Ed448) accept OKP private JWKs where the declared public key 'x' does not match the private key 'd', causing a key identity confusion. This flaw allows an attacker to create a JWK with a legitimate public key but use their own private key for cryptographic operations. In DPoP integrations, this can enable misuse of stolen sender-constrained access tokens without possession of the legitimate private key. The issue is fixed in hermes-agent version 0.22.4.