CVE-2026-102269 MEDIUM

CVE-2026-102269: PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Vendor Jpadilla
Product pyjwt
Weakness CWE-180
Published September 28, 2026
Last update September 29, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.

Key dates

02Disclosure timeline

September 28, 2026 CVE published
September 29, 2026 Record updated