Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-102272, CVE-2026-102273, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, CVE-2026-102272, CVE-2026-102273
By Roy Kalfon |
29 September 2026
Multiple CVEs – PyJWT mixed-algorithm key confusion and JWKS redirect flaws enable JWT forgery and key substitution
PyJWT has multiple flaws enabling token forgery when apps allow both HMAC and asymmetric algs: CVE-2026-102268 accepts mutated public-key PEM as HMAC secret; CVE-2026-102271 accepts DER public key bytes; CVE-2026-102272 accepts UTF-8 BOM-prefixed public JWK; CVE-2026-102273 accepts public JWK containers. CVE-2026-102267 lets PyJWKClient follow attacker-influenced redirects, enabling key substitution/credential disclosure. Upgrade to 2.14.0 to mitigate.