CVE-2026-102269

A flaw was found in PyJWT. When decoding JSON Web Token (JWT) signature segments, the library accepts characters outside the standard Base64URL encoding format. A remote attacker can exploit this issue by appending extra characters to a valid token signature, creating an alternate token representation that decodes to the identical signature. Consequently, this can allow an attacker to bypass raw-token revocation checks or blocklists that rely on exact string matching.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.