Threats tagged 'brew-localstack-cve-2026-102275'

PyJWT versions from 2.1.0 up to but not including 2.15.0 contain a vulnerability in the OKPAlgorithm.from_jwk function where the private JWK import does not verify that the public key component x corresponds to the private key component d. This can lead to a mismatch between the identity derived from x and operations performed with d. If an integration accepts private key parameters from a proof header without rejecting them, an attacker could misuse a stolen sender-constrained token without possessing the legitimate private key. The issue is fixed in version 2.15.0.