CVE-2026-102266: PyJWT Vulnerability Allows Bypass of HMAC Key Validation
Summary
CVE-2026-102266: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation. Affects pyjwt versions >= 2.13.0, < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PyJWT is a Python library used for encoding and decoding JSON Web Tokens (JWTs). It supports various algorithms for signing tokens, including HMAC. The library is widely used in applications for secure token-based authentication. However, a vulnerability exists in version 2.13.0 that allows the acceptance of empty HMAC keys when using PyJWK, compromising the integrity of token verification.
Vulnerability Detail
The vulnerability arises from inconsistent validation of HMAC keys in PyJWT. When an empty oct JWK is supplied through PyJWK, it bypasses the empty-key validation that would normally reject such keys. This allows attackers to generate valid HS256 JWTs with arbitrary claims, leading to potential authentication bypass, user impersonation, and unauthorized access to protected resources. The issue is particularly concerning as it does not require control over the JWK source or any additional credentials.
How To Fix
Latest published version: 2.15.1 as of 23 Oct 2026
pip install --upgrade "pyjwt==2.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.0
This is the first release that contains the fix.
pip install --upgrade "pyjwt==2.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not use empty HMAC keys in your JWK configuration. Additionally, you can enable minimum key length enforcement by setting enforce_minimum_key_length=True in your JWT decoding options.
Conclusion
The vulnerability CVE-2026-102266 in PyJWT allows for the acceptance of empty HMAC keys through PyJWK, leading to serious security risks. It is crucial to update to the patched version 2.14.0 to mitigate these risks and ensure the integrity of your token-based authentication system.
See every vulnerability recorded for pyjwt →
FAQ
The vulnerability allows attackers to create valid JWTs with arbitrary claims, potentially leading to authentication bypass and unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
PyJWT versions 2.13.0 are affected. The vulnerability is fixed in version 2.14.0.
If you cannot update immediately, ensure that you do not use empty HMAC keys in your JWK configuration and enable minimum key length enforcement.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyjwt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
