CyberRota Analysis
AI-GeneratedPyJWT versions 2.13.0 to 2.14.0 are vulnerable due to a flaw in the HMAC key guard, which improperly accepts public asymmetric key material as HMAC secrets when a public JWK container is passed as the raw key. This vulnerability allows attackers with knowledge of the public key to forge tokens with arbitrary claims, potentially compromising the integrity of applications using these tokens. Organizations utilizing affected versions of PyJWT should prioritize upgrading to version 2.14.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)