CVE-2026-102274

PyJWT is a Python implementation of JSON Web Token standards.

Pyjwt

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of…

28. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-102274
• GitHub
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq