CVE-2026-102269
published 2026-09-28CVE-2026-102269: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.19%
8.2th percentile
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jpadilla | pyjwt | < 2.14.0 | 2.14.0 |
| pyjwt_project | pyjwt | < 2.14.0 | 2.14.0 |
| pyjwt_project | pyjwt | >= 0 < 2.14.0 | 2.14.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding
vendor_redhat·2026-09-28·CVSS 4.8
CVE-2026-102269 [MEDIUM] CWE-1286 pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding
pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.
A flaw was found in PyJWT. When decoding JSON Web Token (JWT) signature segments, the library accepts characters outside the standard Base64URL encoding format. A remote attacke
GHSA
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
ghsa·2026-09-29
CVE-2026-102269 [MEDIUM] CWE-180 PyJWT: Non-canonical signature segments enable raw-token revocation bypass
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
## Summary
PyJWT 2.13.0 accepts compact JWS signature segments containing characters that
are not in the Base64URL alphabet. Appending `!!!!` to a valid signature does
not change the decoded signature bytes or authenticated claims, but it changes
the serialized token and its SHA-256 hash. An application that indexes logout
or revocation state by the raw token therefore rejects the logged-out token and
accepts its no-key alternate serialization.
This report separates two issues: permissive compact-JWS decoding is the
library behavior, while using raw serialized JWT text as a security identity is
a dangerous application composition. A `jti`-indexed control blocks both
representations.
## Affected Version
Confirme
VulDB
jpadilla PyJWT up to 2.13.x Signature Segment improper authentication
vuldb·2026-09-28·CVSS 4.8
CVE-2026-102269 [MEDIUM] jpadilla PyJWT up to 2.13.x Signature Segment improper authentication
A vulnerability has been found in jpadilla PyJWT up to 2.13.x and classified as critical. This vulnerability affects unknown code of the component Signature Segment. Performing a manipulation results in improper authentication.
This vulnerability was named CVE-2026-102269. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
2026-09-28
Published