{"uuid": "48fe304a-6155-47e3-a97b-8352fc501344", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102266", "type": "seen", "source": "https://gist.github.com/alon710/021c63a7b1d8134c56a782a255bf9e1a", "content": "# CVE-2026-102266: CVE-2026-102266: Signature Verification Bypass in PyJWT via Empty JWK\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102266\n\n## Summary\nA signature verification bypass vulnerability in PyJWT allows unauthenticated remote attackers to forge JSON Web Tokens when processing JSON Web Key Sets containing an empty symmetric key.\n\n## TL;DR\nPyJWT versions 2.13.0 to 2.14.0 fail to validate key lengths on PyJWK paths, allowing attackers to forge tokens with an empty HMAC key if a trusted JWK contains an empty 'k' parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 7.4\n- **EPSS**: 0.00175\n- **Impact**: Authentication Bypass / Privilege Escalation\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- pyjwt (Python implementation of JSON Web Token)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or later\n- Enforce minimum key length configuration options\n- Sanitize and validate incoming JWK Sets to reject empty keys\n\n**Remediation Steps:**\n1. Identify vulnerable PyJWT installations\n2. Update the library dependency to 2.14.0\n3. Deploy updated configuration parameters to enforce key length checks\n\n## References\n\n- [NVD Reference](https://nvd.nist.gov/vuln/detail/CVE-2026-102266)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-102266)\n- [GitHub Advisory Database](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r)\n- [Official Release Notes](https://github.com/jpadilla/pyjwt/releases/tag/2.14.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102266) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T13:30:31.000000Z"}