USN-8916-2: PyJWT vulnerabilities
Publication date
15 October 2026
Overview
Several security issues were fixed in PyJWT.
Releases
Packages
- pyjwt - Python 3 implementation of JSON Web Token
Details
USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the
corresponding fix for PyJWT on Ubuntu 26.10.
Original advisory details:
YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forge authentication tokens. (CVE-2026-102266)
Rohan Das discovered that PyJWT incorrectly handled redirects when fetching
key sets. A remote attacker could possibly use this issue to cause PyJWT
to disclose sensitive information. (CVE-2026-102267)
It was discovered that PyJWT incorrectly recognized certain PEM
representations. An attacker who knew the public key could possibly use
this issue to forge authentication tokens. (CVE-2026-102268)
Nuno Lopes discovered that PyJWT incorrectly handled DER public...
USN-8916-1 fixed vulnerabilities in PyJWT. This update provides the
corresponding fix for PyJWT on Ubuntu 26.10.
Original advisory details:
YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forge authentication tokens. (CVE-2026-102266)
Rohan Das discovered that PyJWT incorrectly handled redirects when fetching
key sets. A remote attacker could possibly use this issue to cause PyJWT
to disclose sensitive information. (CVE-2026-102267)
It was discovered that PyJWT incorrectly recognized certain PEM
representations. An attacker who knew the public key could possibly use
this issue to forge authentication tokens. (CVE-2026-102268)
Nuno Lopes discovered that PyJWT incorrectly handled DER public keys when
performing HMAC verification. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102271)
It was discovered that PyJWT did not properly handle certain JWK keys
prefixed with a byte-order mark. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102272)
Charles Vosburgh discovered that PyJWT incorrectly handled certain JWK
containers when performing HMAC verification. An attacker who knew the
public key could possibly use this issue to forge authentication tokens.
(CVE-2026-102273)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.10 stonking | python3-jwt – 2.13.0-1ubuntu1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.