Threats tagged 'brew-rapid-mlx-cve-2026-102273'

PyJWT versions from 2.13.0 up to but not including 2.14.0 contain a vulnerability in the HMACAlgorithm.prepare_key function. The issue arises because the HMAC key guard only recognizes top-level public JWK forms and misses container representations, allowing public asymmetric key material to be accepted as the HMAC secret. This flaw enables an attacker who knows the public key to forge tokens with arbitrary authenticated claims. The vulnerability is fixed in version 2.14.0.