PyJWT HS256/384/512 token forgery via empty HMAC key in oct JWK

Severity: high · CVSS 7.4 · Published 2026-10-22

PyJWT is a library for signing and verifying JSON Web Tokens (JWTs), which are commonly used for API authentication and authorization. This vulnerability allows an attacker to forge valid authentication tokens with arbitrary claims (such as admin privileges) without knowing any secret, enabling account takeover and privilege escalation on applications using the PyJWK or PyJWKClient verification paths. The flaw occurs when a signing secret is unset or empty, a common misconfiguration that the library's earlier protections failed to guard against in the JWK code path.

Technologies: PyJWT, pyjwt (PyPI). Vendors: PyJWT, PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.4, published 22 October 2026.
Which products and versions are affected?
PyJWT <= 2.13.0; pyjwt (PyPI) <= 2.13.0, ECOSYSTEM:introduced=0,fixed=2.14.0.
Is there a fix for This vulnerability?
Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Until then: Until patched, ensure that signing secrets are never empty by validating environment variables and configuration at application startup, and audit any published JWKS to confirm that oct key entries have non-empty 'k' values; if a JWKS does contain such entries, regenerate with a proper secret and reissue tokens. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pyjwt (PyPI): upgrade to 2.14.0 or later
    pip install "pyjwt>=2.14.0"

Until patched, ensure that signing secrets are never empty by validating environment variables and configuration at application startup, and audit any published JWKS to confirm that oct key entries have non-empty 'k' values; if a JWKS does contain such entries, regenerate with a proper secret and reissue tokens.

Technical details

The vulnerability exists in HMACAlgorithm.from_jwk(), which decodes a symmetric oct-type JWK's empty 'k' value to an empty byte string without validation, while the sibling prepare_key() method correctly rejects empty HMAC keys. When verifying tokens through PyJWK/PyJWKSet/PyJWKClient, an attacker can forge a token signed with the empty key (HMAC with an empty secret produces a deterministic output) and supply a kid pointing to the empty-k JWK entry; the token verifies successfully because HMAC(key=b"", message) produces a valid signature that any attacker can compute locally. No authentication, network elevation, or user interaction is required—only that the server's JWKS contains an oct entry with empty k (typically from an unset environment variable or config value).

Affected products

  • PyJWT PyJWT <= 2.13.0

Timeline

  • 2026-10-22: disclosed
  • 2026-09-11: patched: Fixed in PyJWT 2.14.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.