{"action":"Upgrade pyjwt to 2.14.0 or later.","affected":[{"fixed":"2.14.0","introduced":"0"}],"component":"pyjwt","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2.14.0"],"ghsa_id":"GHSA-pxh4-856f-4h89","id":"tcs_01M5JMC78BJADD12RKQW6BV010","modified_at":"2026-10-22T16:00:09.127222029Z","published_at":"2026-10-22T15:48:04Z","references":["https://osv.dev/vulnerability/GHSA-pxh4-856f-4h89","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89","https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb","https://github.com/jpadilla/pyjwt","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-pxh4-856f-4h89","url":"https://osv.dev/vulnerability/GHSA-pxh4-856f-4h89"}],"summary":"PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery"}