PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT
    OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare
    the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and
    d components. As a result, identity derived from x can differ from operations performed with d.
    Consequently, if an integration also accepts private key parameters from a proof header without rejecting
    them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue
    is fixed in version 2.15.0. (CVE-2026-102275)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT     OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare     the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and     d components. As a result, identity derived from x can differ from operations performed with d.
    Consequently, if an integration also accepts private key parameters from a proof header without rejecting     them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue     is fixed in version 2.15.0. (CVE-2026-102275)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473215	Echo: pyjwt: security update to 2.15.1-1pyjwt: security update to 2.15.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
473215	Echo: pyjwt: security update to 2.15.1-1pyjwt: security update to 2.15.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
472950	SCA: security update for PyJWT (GHSA-x33g-cr3x-6449)	Tenable Cloud Security	SCA Checks	Local	high
472950	SCA: security update for PyJWT (GHSA-x33g-cr3x-6449)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
351358	Linux Distros Unpatched Vulnerability : CVE-2026-102275	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102275

high

Tenable Plugins

high

high

high

high

high