CVEvulnerability

CVE-2026-102269

5.4 MEDIUM Published 2026-09-28 Modified 2026-10-06 Official page ↗
Status
Analyzed
Published
2026-09-28
Last modified
2026-10-06
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-180

Description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.

Affected configurations

• pyjwt project pyjwt (< 2.14.0)

Related

Weakness · CWE (1)

  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize weakness

References