jpadilla PyJWT up to 2.14.x OKPAlgorithm jwt/algorithms.py OKPAlgorithm.from_jwk comparison

Summaryinfo

A vulnerability marked as critical has been reported in jpadilla PyJWT up to 2.14.x. Affected by this vulnerability is the function OKPAlgorithm.from_jwk of the file jwt/algorithms.py of the component OKPAlgorithm. The manipulation leads to comparison. This vulnerability is documented as CVE-2026-102275. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in jpadilla PyJWT up to 2.14.x. It has been rated as critical. This issue affects the function OKPAlgorithm.from_jwk of the file jwt/algorithms.py of the component OKPAlgorithm. The manipulation with an unknown input leads to a comparison vulnerability. Using CWE to declare the problem leads to CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-102275 since 09/28/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.15.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• jpadilla

Name

• PyJWT

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14

Website

• Product: https://github.com/jpadilla/pyjwt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion