PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not
    catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in
    jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys.
    As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications
    can experience authentication failures or request-level denial of service. This issue is fixed in version
    2.14.0. (CVE-2026-102274)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not     catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in     jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys.
    As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications     can experience authentication failures or request-level denial of service. This issue is fixed in version     2.14.0. (CVE-2026-102274)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458530	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
458530	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351346	Linux Distros Unpatched Vulnerability : CVE-2026-102274	Nessus	Misc.	Local	high
448479	SCA: security update for PyJWT (GHSA-w6j9-cwv2-h6wq)	Tenable Cloud Security	SCA Checks	Local	high
448479	SCA: security update for PyJWT (GHSA-w6j9-cwv2-h6wq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-102274

high

Tenable Plugins

high

high

high

high

high