Is CVE-2026-102266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102266 being exploited in the wild.

How severe is CVE-2026-102266?

High severity, with a CVSS score of 7.4, published 28 September 2026.

Which products and versions are affected?

Jpadilla PyJWT 2.13.0 to 2.13.x; pyjwt (PyPI) >= 2.13.0, < 2.14.0, ECOSYSTEM:introduced=2.13.0,fixed=2.14.0.

Is there a fix for CVE-2026-102266?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102266 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102266?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102266: PyJWT HMAC key validation bypass in JWK parsing

Q: Is there a fix for CVE-2026-102266?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102266 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102266?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102266 · Severity: high · CVSS 7.4 · Published 2026-09-28

PyJWT is a Python library for creating and verifying JSON Web Tokens, which are used for secure authentication and authorization in modern applications. Versions 2.13.0 through 2.14.0 accept zero-length HMAC keys from trusted JWK Sets without proper validation, allowing an attacker to forge authentication tokens with arbitrary claims that will be accepted as legitimate.

Technologies: Jpadilla PyJWT, pyjwt (PyPI). Vendors: Jpadilla, PyPI.

Quick answers

Is CVE-2026-102266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102266 being exploited in the wild.
How severe is CVE-2026-102266?: High severity, with a CVSS score of 7.4, published 28 September 2026.
Which products and versions are affected?: Jpadilla PyJWT 2.13.0 to 2.13.x; pyjwt (PyPI) >= 2.13.0, < 2.14.0, ECOSYSTEM:introduced=2.13.0,fixed=2.14.0.
Is there a fix for CVE-2026-102266?: Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102266 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102266?: Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.14.0 or later
```
pip install "pyjwt>=2.14.0"
```

Technical details

The HMACAlgorithm.from_jwk method fails to apply prepare_key validation to the decoded key material when processing oct (symmetric key) entries from a JWK Set. An attacker can exploit this by crafting a JWK Set entry with an empty k value; PyJWT will accept this zero-length key for token verification, enabling the attacker to sign forged tokens with the same weak key. The vulnerability requires network access to the token verification endpoint and trust in a compromised or attacker-controlled JWK Set.

Affected products

jpadilla PyJWT 2.13.0 to 2.13.x

Identifiers

CVE-2026-102266
GHSA-9j54-fg26-wv3r
PYSEC-2026-4143

Timeline

2026-09-28: disclosed
2026-09: patched: Fixed in version 2.14.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.