CVE-2026-102275 jpadilla CVE debrief

Who should care

Defenders of systems using PyJWT for cryptographic operations, especially in DPoP integrations, should assess exposure and verify PyJWT versions. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the secure use of PyJWT in their environments. They should review the CVE record and advisory details to understand the vulnerability's impact and implement necessary mitigations or fixes.

Why it matters

PyJWT's inconsistent OKP JWK handling may enable unauthorized access token use in DPoP integrations, requiring verification of PyJWT versions and assessment of DPoP integrations.

• Potential unauthorized access token usage in DPoP integrations
• Public/private key identity confusion in cryptographic operations

Technical summary

PyJWT's OKPAlgorithm.from_jwk() constructs Ed25519/Ed448 private keys from 'd' without verifying the public key derived from 'd' matches 'x'. This oversight enables potential unauthorized access token usage in DPoP integrations due to public/private key identity confusion. The vulnerability arises from inconsistent OKP private JWKs acceptance, affecting cryptographic operations in PyJWT. Defenders should verify PyJWT versions and assess DPoP integrations for exposure to this vulnerability. Affected systems may require updates to ensure secure cryptographic operations.

Defensive priority

Verify PyJWT version and assess DPoP integrations for potential exposure

Recommended defensive actions

• Verify PyJWT version is 2.15.0 or later
• Assess DPoP integrations for potential exposure
• Update affected PyJWT versions
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue arises from PyJWT's acceptance of internally inconsistent OKP private JWKs, where the declared public key 'x' does not match the supplied private key 'd'. This inconsistency can lead to public/private key identity confusion in cryptographic operations, potentially allowing unauthorized access token usage in DPoP integrations. Defenders should verify PyJWT versions and assess DPoP integrations for exposure. Evidence is limited to public sources and CVE record details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.