vulnerability · Tue 29 Sep 2026 · 23:14 UTC
GHSA-r6x4-923q-g947: PyJWT BOM Bypass
Filed UTCSource GTH ↗
Affected Package - Package: PyJWT (pyjwt on PyPI) - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- ## Root Cause PyJWT 2.13.0 introduced a guard in HMACAlgorithm.prepare_key() (file jwt/algorithms.py, approximately line 344) to prevent RSA public key material from being used as an HMAC secret — the root cause of CVE-2026-48526. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability — CVSS 7.4
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-102272 | — | 0.18% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.