PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)
• Critical severity: CVSS 9.1

[ Description ]Official description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

[ Fixes ]Fixes and patches

• PyJWT 2.14.0Fixed version · GitHub Advisories · pip package PyJWT: upgrade to 2.14.0 or later (affected <= 2.13.0)
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4111

  Red Hat Ansible Automation Platform: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-11332CVE-2026-102938CVE-2026-103262+21 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs

[ Packages ]Affected open-source packages

• PyJWT pipAffected <= 2.13.0 · fixed in 2.14.0 · GHSA-ffc3-869f-jxw9

[ References ]References

• github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07Patch
• github.com/jpadilla/pyjwt/releases/tag/2.14.0ProductRelease Notes
• github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9ExploitVendor Advisory