Threats tagged 'brew-hermes-agent-cve-2026-48526'

PyJWT versions from 2026.4.30 up to but not including 2026.7.1 contain a vulnerability where a verifier configured to accept both symmetric (HMAC) and asymmetric algorithms can be tricked into accepting a public JSON Web Key (JWK) as an HMAC secret. This allows an attacker to forge HS256 tokens by using the issuer's public key as the HMAC secret, enabling unauthorized token creation and impersonation. The vulnerability arises because the library only blocks asymmetric keys in PEM or SSH format from being used as HMAC secrets, but does not block JSON Web Keys. This flaw requires a misconfiguration of the verifier and is rated with high attack complexity. A fix is available in version 2026.7.1.