P4 Verified
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
CVE-2026-102268 affects azl3 python-jwt 2.13.0-1 on Azure Linux 3.0. CVSS base score 9.1 (msrc). EPSS 0.00196 (percentile 0.08369), scored 2026-10-03. Fixed version: 2.13.0-1+e2. Fixed version: 2.14.0.
- CVE / CWE
- CVE-2026-102268 /
- Vendor / product
- Unavailable / azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
- Severity
- 36.4
- CVSS
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · msrc
- EPSS
- 0.00196 · percentile 0.08369 · 2026-10-03
- KEV
- no · added unavailable · due unavailable · ransomware use unavailable
- Exploit signals
- Signal evidence
Affected products
- azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
- pyjwt · Fixed version: 2.13.0-1+e2
- pyjwt · Fixed version: 2.14.0
Provenance
- Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
- OSV.dev · Source record · observed 2026-10-04 09:27:46.047644+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-102268.html