CVE-2026-102274

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.9.0 through 2.13.x

Description PyJWT fails to handle a ValueError triggered by the RSAAlgorithm.from jwk() function in jwt/api jwk.py when processing malformed RSA JSON Web Key (JWK) components. If a JWK Set contains a single malformed RSA key among valid keys, the construction of the entire PyJWKSet is aborted. This can lead to authentication failures or request-level denial of service for applications relying on this process.

Recommendations Update to version 2.14.0.