Is CVE-2026-102273 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102273 being exploited in the wild.

How severe is CVE-2026-102273?

High severity, with a CVSS score of 7.4, published 28 September 2026.

Which products and versions are affected?

PyJWT 2.13.0 through 2.13.x; pyjwt (PyPI) = 2.13.0, ECOSYSTEM:introduced=2.13.0,fixed=2.14.0.

Is there a fix for CVE-2026-102273?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102273 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102273?

Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102273: PyJWT HMAC key validation bypass in HMACAlgorithm.prepare_key

CVE-2026-102273 · Severity: high · CVSS 7.4 · Published 2026-09-28

PyJWT is a widely-used library for signing and validating JSON Web Tokens (JWTs) in Python applications. A flaw in versions 2.13.0 through 2.13.x allows attackers to forge valid tokens by exploiting improper validation of HMAC keys when public key material is provided in JSON format. An attacker with knowledge of an application's public cryptographic key can create tokens with arbitrary claims that will be accepted as authentic.

Technologies: PyJWT, pyjwt (PyPI). Vendors: PyJWT, PyPI.

Quick answers

Is CVE-2026-102273 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102273 being exploited in the wild.
How severe is CVE-2026-102273?: High severity, with a CVSS score of 7.4, published 28 September 2026.
Which products and versions are affected?: PyJWT 2.13.0 through 2.13.x; pyjwt (PyPI) = 2.13.0, ECOSYSTEM:introduced=2.13.0,fixed=2.14.0.
Is there a fix for CVE-2026-102273?: Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102273 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102273?: Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.14.0 or later
```
pip install "pyjwt>=2.14.0"
```

Technical details

The HMACAlgorithm.prepare_key method fails to properly validate that HMAC keys are not public key material when it accepts JWK container representations. When an application accepts both HMAC and asymmetric signing algorithms and passes a public key as raw JWK JSON bytes, the validation logic incorrectly treats the public key as an HMAC secret. This allows an attacker to forge tokens with arbitrary claims. The fix adds stricter validation to reject public key containers when used as HMAC keys.

Affected products

PyJWT PyJWT 2.13.0 through 2.13.x

Identifiers

CVE-2026-102273
GHSA-w2cx-738m-mc7w
PYSEC-2026-4151

Timeline

2026-09-28: disclosed
2026-09-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.