CVE-2026-102268 in PyJWT
Summary
by MITRE • 09/29/2026
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in PyJWT versions prior to 2.14.0 stems from a critical flaw in the input validation logic within the jwt/utils.py module, specifically affecting the is_pem_format function. This function serves as a gatekeeper for determining whether an incoming key string represents a valid PEM-encoded public or private key. The core technical deficiency lies in its inability to recognize every valid PEM representation that is accepted by the underlying cryptography library loader. In practical terms, this means that certain syntactically correct and cryptographically valid PEM strings are incorrectly flagged as non-PEM data. This oversight creates a dangerous ambiguity in how keys are processed during token verification or signing operations, particularly when an application configuration involves mixing HMAC-based algorithms with asymmetric cryptographic algorithms such as RSA or ECDSA.
The operational impact of this flaw is severe because it enables a key confusion attack scenario. When an application mixes HMAC and asymmetric algorithms, the security model relies on strict separation between symmetric secrets used for HMAC signatures and public keys used for verifying digital signatures. However, due to the flawed PEM detection logic, if an attacker supplies a mutated or specifically crafted public-key PEM string as raw key bytes, the system fails to identify it as a valid asymmetric key structure. Consequently, the HMACAlgorithm.prepare_key method misinterprets this unrecognized asymmetric public key and treats it as a symmetric HMAC secret. This misclassification fundamentally breaks the authentication model because HMAC algorithms require secrecy of the signing key, whereas public keys are intended for verification only.
This vulnerability allows an attacker who knows or can obtain the application's public key to forge valid authenticated tokens. Since the system incorrectly uses the public key material as the shared secret for HMAC generation, any party with access to that public key can compute a valid signature for arbitrary payloads. This effectively nullifies the integrity and authenticity guarantees provided by JWTs in mixed-algorithm environments. An attacker could craft malicious tokens that appear legitimate to downstream services or APIs relying on PyJWT for authentication, potentially leading to unauthorized access, privilege escalation, or data tampering depending on how these forged tokens are consumed within the application architecture.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-345 Insufficient Verification of Data Authenticity. The failure to correctly validate the format of cryptographic keys before processing them represents a classic input validation error that leads to security misconfiguration in the context of key handling. In terms of adversary tactics, this vulnerability facilitates techniques associated with ATT&CK T1078 Valid Accounts and potentially T1556 Modifying Authentication Process, as it allows an attacker to bypass authentication mechanisms by exploiting weaknesses in how cryptographic keys are identified and utilized during token verification.
The recommended mitigation is straightforward but critical for all systems relying on PyJWT versions prior to 2.14.0. Organizations must upgrade the PyJWT library to version 2.14.0 or later, where this issue has been resolved by enhancing the PEM format detection logic to correctly identify all valid representations accepted by the cryptography loader. Additionally, developers should review their application configurations to ensure strict adherence to algorithm policies. It is best practice to avoid mixing HMAC and asymmetric algorithms in a way that allows key material confusion; instead, applications should explicitly specify which keys are used for signing versus verification and enforce these constraints at the code level rather than relying solely on library defaults. Regular dependency audits and patch management processes are essential to prevent exploitation of such cryptographic implementation flaws.