CVE-2026-102271

A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules (DER) format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code (HMAC) operations. If an application supports both asymmetric and symmetric signing algorithms, a remote attacker knowing the public key can exploit this flaw to forge valid authentication tokens and bypass access controls.

This vulnerability is rated as Important because an attacker can forge valid JSON Web Tokens and bypass authentication mechanisms if public cryptographic keys are mistakenly treated as shared secrets. Exploitation requires a specific application scenario where both asymmetric and HMAC algorithms are concurrently permitted during signature verification and public keys are provided in raw DER binary format. Typical Red Hat product integrations do not employ this vulnerable algorithm combination or key encoding by default, which restricts the overall attack surface in standard production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.