PyPI/pyjwt: high 7.4

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Action: Upgrade pyjwt to 2.14.0 or later.

pip install pyjwt==2.14.0

Affected

Fixed versions

Sources

• osv: GHSA-pxh4-856f-4h89
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89
• https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb
• https://github.com/jpadilla/pyjwt
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0

published 2026-10-22T15:48:04Z · modified 2026-10-22T16:00:09.127222029Z · JSON