Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-3298)

critical Nessus Plugin ID 371882

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3298 advisory.

A flaw was found in PyJWT. A remote attacker can trigger a Denial of Service (DoS) through outbound request amplification by submitting tokens containing unknown key identifiers. Because the library does not cache lookup failures or enforce a minimum refresh interval when fetching signing keys, each invalid key identifier forces a new request to the remote JSON Web Key Set (JWKS) server. This allows an attacker to exhaust network resources and overwhelm the configured authentication endpoints. (CVE-2026-101917)

A flaw was found in PyJWT. When processing a JSON Web Token (JWT) prior to signature verification, the parser fails to properly handle deeply nested data, leading to an unhandled recursion error. A remote unauthenticated attacker could exploit this flaw by submitting a specially crafted token, causing the application to raise an unexpected server exception and resulting in a Denial of Service (DoS).
(CVE-2026-101918)

A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key (JWK) set that contains an empty Hash-based Message Authentication Code (HMAC) key, the library fails to enforce key-length validation. This allows an attacker to generate valid tokens carrying arbitrary claims to gain unauthorized access. (CVE-2026-102266)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0. (CVE-2026-102267)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0. (CVE-2026-102268)

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0. (CVE-2026-102271)

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric- key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0. (CVE-2026-102272)

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0. (CVE-2026-102273)

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d.
Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0. (CVE-2026-102275)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update python-jwt --releasever 2023.12.20261026' or or 'dnf update --advisory ALAS2023-2026-3298 --releasever 2023.12.20261026' to update your system.

Plugin Details

Severity: Critical

ID: 371882

File Name: al2023_ALAS2023-2026-3298.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 10/25/2026

Updated: 10/25/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.23

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-102267

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:python3-jwt, p-cpe:/a:amazon:linux:python3-jwt%2bcrypto

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/24/2026

Vulnerability Publication Date: 9/28/2026

Reference Information

CVE: CVE-2026-101917, CVE-2026-101918, CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, CVE-2026-102272, CVE-2026-102273, CVE-2026-102275

Detections

Analytics