PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT
    HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms
    and misses container representations. This occurs when an application allows HMAC and asymmetric
    algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material
    is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with
    arbitrary authenticated claims. This issue is fixed in version 2.14.0. (CVE-2026-102273)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT     HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms     and misses container representations. This occurs when an application allows HMAC and asymmetric     algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material     is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with     arbitrary authenticated claims. This issue is fixed in version 2.14.0. (CVE-2026-102273)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471618	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
471618	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351182	Linux Distros Unpatched Vulnerability : CVE-2026-102273	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102273

high

Tenable Plugins

high

high

high