A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key (JWK) set that contains an empty Hash-based Message Authentication Code (HMAC) key, the library fails to enforce key-length validation. This allows an attacker to generate valid tokens carrying arbitrary claims to gain unauthorized access.
Last checked: 2026-09-30 21:40 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-29 19:28 UTC)
Fix evidence last checked: 2026-10-04 14:36 UTC
Debian 12 (Bookworm)
Debian Security Tracker · Observed 2026-10-04