CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
Prerequisites (both conditions must hold; both are deployment properties, not attacker-controlled at request time):
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1)
- EPSS
- 0.2% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- PyJWT (pip) <= 2.13.0, fixed in 2.14.0 · GHSA-ffc3-869f-jxw9