Is CVE-2026-102272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102272 being exploited in the wild.

How severe is CVE-2026-102272?

High severity, with a CVSS score of 7.4, published 28 September 2026.

Which products and versions are affected?

Jpadilla PyJWT 2.13.0 to 2.13.x (patched in 2.14.0); pyjwt (PyPI) = 2.13.0, ECOSYSTEM:introduced=2.13.0,fixed=2.14.0.

Is there a fix for CVE-2026-102272?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102272 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102272?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102272: PyJWT HMAC key confusion via BOM-prefixed public JWK

CVE-2026-102272 · Severity: high · CVSS 7.4 · Published 2026-09-28

PyJWT, a library used to validate JSON Web Tokens (JWTs) for API authentication and authorization, contains a flaw in versions 2.13.0 through 2.14.0 that allows attackers to forge valid tokens. When a public key is prefixed with a special Unicode byte-order mark (BOM), the library incorrectly treats it as an HMAC secret instead of rejecting it. An attacker who knows the public key can exploit this to create fraudulent authentication tokens and gain unauthorized access to systems relying on JWT validation.

Technologies: Jpadilla PyJWT, pyjwt (PyPI). Vendors: Jpadilla, PyPI.

Quick answers

Is CVE-2026-102272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102272 being exploited in the wild.
How severe is CVE-2026-102272?: High severity, with a CVSS score of 7.4, published 28 September 2026.
Which products and versions are affected?: Jpadilla PyJWT 2.13.0 to 2.13.x (patched in 2.14.0); pyjwt (PyPI) = 2.13.0, ECOSYSTEM:introduced=2.13.0,fixed=2.14.0.
Is there a fix for CVE-2026-102272?: Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102272 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102272?: Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.14.0 or later
```
pip install "pyjwt>=2.14.0"
```

Technical details

The vulnerability exists in HMACAlgorithm.prepare_key in jwt/algorithms.py, where the raw-JWK detector fails to normalize Unicode byte-order marks before JSON parsing. When a public JWK with a UTF-8 BOM is processed in a mixed-algorithm verification path, it bypasses asymmetric-key detection and becomes usable as an HMAC secret. An attacker with knowledge of the public key can forge tokens that pass HMAC verification. The issue is patched in version 2.14.0.

Affected products

jpadilla PyJWT 2.13.0 to 2.13.x (patched in 2.14.0)

Identifiers

CVE-2026-102272
GHSA-r6x4-923q-g947
PYSEC-2026-4150

Timeline

2026-09-28: disclosed
2026-09: patched: Fixed in version 2.14.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.