CVE-2026-102275: jpadilla pyjwt
CVSS: 8.2v3.1HighAnalyzed
AliasesGHSA-x33g-cr3x-6449PYSEC-2026-4183UBUNTU-CVE-2026-102275DEBIAN-CVE-2026-102275CGA-2c58-5mfg-9vhxCGA-2hrv-x49x-xpmrCGA-4m82-6c2j-m43cCGA-7fmr-vc7p-h4xrCGA-97g8-pvqv-wqx5CGA-cp3h-2c74-664hCGA-rmh5-pwv9-8qpwCGA-whp6-rj54-pwg6CGA-23pf-f752-r9m3CGA-2j4g-vrmq-6q6cCGA-2pfc-r4h7-7f2mCGA-2q9g-4vw7-46qjCGA-2r6p-qc98-6c6vCGA-2wmc-w69r-6qj9CGA-2wpr-r6pf-cpp7CGA-368g-xh2w-gp4fCGA-389p-mmr5-x5pmCGA-43hh-fwxv-vxghCGA-46r3-hcwg-6fq4CGA-4cr5-qw24-5hgqCGA-4pcf-pg53-r34cCGA-53qv-w7m3-x45jCGA-53v4-pfj5-fqrgCGA-5q5v-6549-wpj6CGA-5x69-qvq3-7jwcCGA-5xpp-q48p-jr72CGA-6gvg-788j-7xqvCGA-6jj4-c4hf-m4w2CGA-739q-f92m-rp69CGA-74m3-r5j8-233hCGA-82v4-w2r6-78fcCGA-8hvg-2qrm-ppv5CGA-8q6g-hfp6-6p8wCGA-9jm4-2w2q-hmpjCGA-9r36-vj72-cq7mCGA-c2mx-q5q6-8ffcCGA-c3f9-9grj-4485CGA-c58w-mg9r-c8p5CGA-c5qv-mv7g-qmcrCGA-c727-2qp9-mmxmCGA-cqq6-43rw-gqgjCGA-cw3r-g76j-pj8xCGA-f85m-v5px-3vwpCGA-fh33-wm32-rxf3CGA-fj3h-f293-6rjmCGA-fw7c-8h62-jxmwCGA-g2c5-grfq-4xh7CGA-g6j9-vq48-f7gvCGA-gv9p-336p-5hrhCGA-gvq7-gq2g-ppjpCGA-gx2m-98x5-w2j4CGA-h23f-7779-xfj9CGA-h9w5-w8vr-3p78CGA-hf9g-cgxq-f7g5CGA-hgfc-rm9q-mf2qCGA-hqmc-xxq6-7rr3CGA-jqrj-3fqr-jv95CGA-jqx2-75f3-rg5gCGA-jx7h-6rpq-696hCGA-mc7w-x69r-fm3wCGA-mf97-vf2p-84jcCGA-mrmf-gjr8-388xCGA-pc4x-97hr-rp9rCGA-pg99-m4c7-7wv3CGA-pvgx-vjgp-ffm6CGA-xf58-qgh7-3gxwCGA-q3hp-3xj9-xj7qCGA-qqpp-fh7h-vfq9CGA-qw23-884j-wj74CGA-qxrf-fwj3-53wxCGA-r77w-jv4v-5qgvCGA-r96r-cv88-rp5rCGA-rjq4-q2pg-372wCGA-rqw6-68x4-rgx7CGA-rvwh-5vw7-mw8pCGA-v26f-g8c2-p22rCGA-v2fg-pr7x-8g7cCGA-vrmw-27w2-46j7CGA-w9x7-83cg-6946CGA-wfvf-wcx3-794fCGA-x742-36hr-3qqvCGA-x944-7c46-5977
Published 28-09-2026Last modified 29-09-2026
Vulnerability summary
CVE-2026-102275 is a high (CVSS 8.2) vulnerability in jpadilla pyjwt. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.2/10
010
High · v3.1 (NVD)EPSS score
0.14%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 29-09-2026Last modifiedVulnerability information updated.
Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 8.2Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NSources7 sources · 6.5–8.2
- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NDiffers
- OSV · PypiEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NDiffers
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
29-09-202619-10-2026
EPSS score0.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPyjwt
Maturity: poc
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Affected systems
Chainguard42 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- awx< 24.6.1-r67
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
Wolfi4 products
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.80-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.81-core-integrationsAll versions (No fix recorded)
Debian1 product
- pyjwtAll versions (No fix recorded) | < 2.15.0-1
Jpadilla1 product
- pyjwt≥ 2.1.0, < 2.15.0
Pyjwt_project1 product
- pyjwt≥ 2.1.0, < 2.15.0
PyPI1 product
- pyjwt≥ 2.1.0, < 2.15.0
Ubuntu1 product
- pyjwtAll versions (No fix recorded)
7 vendors · 51 products
References
9 links- github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449X Refsource CONFIRMWEBEVIDENCEREPORTAdvisoryExploitVendor Advisory
- github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332cX Refsource MISCWEBFIXREPORTPatch
- github.com/jpadilla/pyjwtPACKAGE
