A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key (JWK) set that contains an empty Hash-based Message Authentication Code (HMAC) key, the library fails to enforce key-length validation. This allows an attacker to generate valid tokens carrying arbitrary claims to gain unauthorized access.
Last checked: 2026-10-07 21:10 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-29 19:28 UTC)
Exploit reference · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · View external evidence (Observed 2026-10-07 21:10 UTC)
Fix evidence last checked: 2026-10-20 08:15 UTC
Debian 12 (Bookworm)
Debian Security Tracker · Observed 2026-10-04
Ubuntu 22.04 LTS (Jammy Jellyfish)
USN-8916-1 · Published 2026-10-13
Ubuntu 24.04 LTS (Noble Numbat)
USN-8916-1 · Published 2026-10-13
Ubuntu 26.04 LTS (Resolute Raccoon)
USN-8916-1 · Published 2026-10-13
Ubuntu 26.10 (Stonking Stingray)
USN-8916-2 · Published 2026-10-15