CVE-2026-102271

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.4.0 through 2.13.x

Description The HMACAlgorithm.prepare key() function is affected because the asymmetric-key guard relies on textual markers that are absent from DER (Distinguished Encoding Rules) encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. Consequently, PyJWT uses the public DER bytes as an HMAC secret, allowing an attacker who knows the public key to forge authenticated HMAC tokens.

Recommendations Update to version 2.14.0.