Pypi · Pyjwt · CVE-2026-102266
**Name of the Vulnerable Software and Affected Versions**
PyJWT versions 2.13.0 through 2.13.x
**Description**
The `HMACAlgorithm.from jwk()` function is affected because the PyJWK verification path uses the decoded key without applying `prepare key` validation. This occurs when a trusted JSON Web Key (JWK) Set contains an oct entry with an empty `k` variable. An attacker can sign an HMAC token using a zero-length key, allowing forged tokens to carry arbitrary authenticated claims.
**Recommendations**
Update to version 2.14.0.