CVE-2026-102268

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0

Description The is pem format function in jwt/utils.py fails to recognize all PEM representations accepted by the cryptography loader. This occurs when an application uses both HMAC and asymmetric algorithms and provides a mutated public-key PEM as raw key bytes. Consequently, the HMACAlgorithm.prepare key() function treats the unrecognized asymmetric public key as an HMAC secret, allowing an attacker with knowledge of the public key to forge authenticated HMAC tokens.

Recommendations Update to version 2.14.0.