https://vulnerability.circl.lu/sightings/feed 2026-10-03T04:16:43.849401+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/48fe304a-6155-47e3-a97b-8352fc501344/export 2026-10-03T04:16:43.873914+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "48fe304a-6155-47e3-a97b-8352fc501344", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102266", "type": "seen", "source": "https://gist.github.com/alon710/021c63a7b1d8134c56a782a255bf9e1a", "content": "# CVE-2026-102266: CVE-2026-102266: Signature Verification Bypass in PyJWT via Empty JWK\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102266\n\n## Summary\nA signature verification bypass vulnerability in PyJWT allows unauthenticated remote attackers to forge JSON Web Tokens when processing JSON Web Key Sets containing an empty symmetric key.\n\n## TL;DR\nPyJWT versions 2.13.0 to 2.14.0 fail to validate key lengths on PyJWK paths, allowing attackers to forge tokens with an empty HMAC key if a trusted JWK contains an empty 'k' parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-347\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 7.4\n- **EPSS**: 0.00175\n- **Impact**: Authentication Bypass / Privilege Escalation\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- pyjwt (Python implementation of JSON Web Token)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or later\n- Enforce minimum key length configuration options\n- Sanitize and validate incoming JWK Sets to reject empty keys\n\n**Remediation Steps:**\n1. Identify vulnerable PyJWT installations\n2. Update the library dependency to 2.14.0\n3. Deploy updated configuration parameters to enforce key length checks\n\n## References\n\n- [NVD Reference](https://nvd.nist.gov/vuln/detail/CVE-2026-102266)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-102266)\n- [GitHub Advisory Database](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r)\n- [Official Release Notes](https://github.com/jpadilla/pyjwt/releases/tag/2.14.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102266) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T13:30:31.000000Z"} 2026-09-30T13:30:31+00:00 https://vulnerability.circl.lu/sighting/72a38de1-619f-4594-a7bd-0117bc2b1773/export 2026-10-03T04:16:43.874966+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "72a38de1-619f-4594-a7bd-0117bc2b1773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102266", "type": "published-proof-of-concept", "source": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r", "content": "", "creation_timestamp": "2026-09-11T14:20:49.000000Z"} 2026-09-11T14:20:49+00:00