CVE-2026-102272: PyJWT 2.13.0 BOM Bypass Vulnerability
Summary
CVE-2026-102272: PyJWT BOM Bypass. Affects pyjwt versions >= 2.13.0, < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PyJWT is a Python library that allows developers to encode and decode JSON Web Tokens (JWT). It is widely used for authentication and information exchange in web applications. The library supports various algorithms for signing tokens, including HMAC and RSA. However, a vulnerability was discovered in version 2.13.0 that allows an attacker to bypass security checks when using a UTF-8 BOM-prefixed RSA public key as an HMAC secret.
Vulnerability Detail
The vulnerability arises from a flaw in the key validation logic within the HMACAlgorithm.prepare_key() method. Specifically, the method uses bytes.lstrip() to remove only ASCII whitespace, which fails to strip a UTF-8 BOM prefix. As a result, a BOM-prefixed JSON Web Key (JWK) is incorrectly accepted as a valid HMAC secret. This allows an attacker, who knows the target application's RSA public key, to forge JWT tokens with arbitrary claims, leading to complete authentication and authorization bypass. The attack complexity is high, as the attacker must obtain the RSA public key and the verifier must be configured to accept both HMAC and RSA algorithms.
How To Fix
Latest published version: 2.15.1 as of 23 Oct 2026
pip install --upgrade "pyjwt==2.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.0
This is the first release that contains the fix.
pip install --upgrade "pyjwt==2.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, you can implement a workaround by modifying the key validation logic in your application. Here is a pseudocode example of how to strip known BOM prefixes before the JSON detection check:
BOM_PREFIXES = (b'\xef\xbb\xbf', b'\xff\xfe', b'\xfe\xff') stripped = key_bytes for bom in BOM_PREFIXES: if stripped.startswith(bom): stripped = stripped[len(bom):] break stripped = stripped.lstrip()
Conclusion
The PyJWT 2.13.0 BOM Bypass vulnerability allows attackers to exploit improper key validation, leading to serious security risks. It is crucial to update to version 2.14.0 or later to mitigate this issue. Additionally, users can utilize Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for pyjwt →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
PyJWT version 2.13.0 is affected by this vulnerability. The issue is resolved in version 2.14.0.
An attacker can forge JWT tokens with arbitrary claims, leading to unauthorized access and complete authentication bypass.
Yes, you can implement a workaround by modifying the key validation logic to handle BOM prefixes as shown in the provided pseudocode.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyjwt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
