Is CVE-2026-102274 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102274 being exploited in the wild.

How severe is CVE-2026-102274?

Medium severity, with a CVSS score of 5.9, published 28 September 2026.

Which products and versions are affected?

PyJWT 2.9.0 through 2.13.1; pyjwt (PyPI) >= 2.9.0, <= 2.13.0, ECOSYSTEM:introduced=2.9.0,fixed=2.14.0.

Is there a fix for CVE-2026-102274?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102274 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102274?

Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102274: PyJWT unhandled ValueError in JWK Set parsing

Q: Is there a fix for CVE-2026-102274?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102274 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102274?

Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102274 · Severity: medium · CVSS 5.9 · Published 2026-09-28

PyJWT is a Python library that handles JSON Web Tokens, which are widely used for authentication in web applications and APIs. A vulnerability in versions 2.9.0 through 2.14.0 causes the library to crash when processing a JWK Set containing a malformed RSA key, even if other valid keys are present. This can result in authentication failures or denial of service affecting applications that rely on PyJWT for verifying tokens.

Technologies: PyJWT, pyjwt (PyPI). Vendors: PyJWT, PyPI.

Quick answers

Is CVE-2026-102274 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102274 being exploited in the wild.
How severe is CVE-2026-102274?: Medium severity, with a CVSS score of 5.9, published 28 September 2026.
Which products and versions are affected?: PyJWT 2.9.0 through 2.13.1; pyjwt (PyPI) >= 2.9.0, <= 2.13.0, ECOSYSTEM:introduced=2.9.0,fixed=2.14.0.
Is there a fix for CVE-2026-102274?: Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102274 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102274?: Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.14.0 or later
```
pip install "pyjwt>=2.14.0"
```

Technical details

PyJWKSet does not catch the ValueError raised by RSAAlgorithm.from_jwk() in jwt/api_jwk.py when processing malformed RSA JWK components, causing the entire JWK Set construction to fail. The vulnerability occurs when deserializing JWK Sets fetched from remote endpoints or loaded from configuration, which are typically trusted but may contain formatting errors. An attacker with control over a JWK Set endpoint (or via man-in-the-middle in certain configurations) can inject a malformed RSA key to trigger denial of service by preventing token validation.

Affected products

PyJWT PyJWT 2.9.0 through 2.13.1

Identifiers

CVE-2026-102274
GHSA-w6j9-cwv2-h6wq
PYSEC-2026-4152

Timeline

2026-09-28: disclosed
2026-09-11: patched: Fixed in version 2.14.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.