There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is
    affected because signature segment decoding accepts characters outside the canonical Base64URL
    representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature
    segment. As a result, base64url_decode produces the same signature bytes for different serialized
    segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token.
    This issue is fixed in version 2.14.0. (CVE-2026-102269)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - PyJWT 是 JSON Web 令牌標準的 Python 實作。在之前 2.14.0，PyJWT 簽名區段會受到影響，因為簽名區段解碼接受標準 Base64URL 表示法之外的字元。當非 Base64URL 字元附加至有效的緊湊 JWS 簽名區段時，就會發生這種情況。因此，base64url_decode會針對不同的序列化區段產生相同的簽章位元組。因此，原始權杖撤銷檢查可能無法辨識對等的修改權杖。
    2.14.0 版已修正此問題。(CVE-2026-102269)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - PyJWT 是 JSON Web Token 标准的 Python 实现。低于 2.14.0的 PyJWT 签名段会受到影响，因为签名段解码接受规范 Base64URL 表示之外的字符。当非 Base64URL 字符附加至有效的压缩 JWS 签名段时，会发生此情况。因此，base64url_decode 会为不同的序列化段生成相同的签名字节。结果，原始标记吊销检查可能无法识别经过修改的等效标记。
    此问题已在 2.14.0 版本中修复。(CVE-2026-102269)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - PyJWT は、JSON Web トークン標準の Python 実装です。2.14.0より前では、署名セグメントのデコーディングが正規の Base64URL 表現の外の文字を受け入れるため、PyJWT 署名セグメントは影響を受けます。これは、非 Base64URL 文字が有効なコンパクトな JWS 署名セグメントに追加されると発生します。その結果、base64url_decodeは異なるシリアル化されたセグメントに対して同じ署名バイトを生成します。結果として、raw-token 失効チェックは、等価に変更されたトークンを認識できない可能性があります。
    この問題はバージョン 2.14.0 で修正されています。(CVE-2026-102269)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5064-1 advisory.

    - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint     (bsc#1283060).
    - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response     (bsc#1283061).
    - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted     (bsc#1283064).
    - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
    - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token     (bsc#1283066).
    - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
    - CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
    - CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private     key       (bsc#1283072).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is     affected because signature segment decoding accepts characters outside the canonical Base64URL     representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature     segment. As a result, base64url_decode produces the same signature bytes for different serialized     segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token.
    This issue is fixed in version 2.14.0. (CVE-2026-102269)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the python3 package has been released.

ID	Name	Product	Family	Published	Updated	Severity
465424	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/13/2026	medium
465424	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/13/2026	medium
351251	Linux Distros 未修補弱點：CVE-2026-102269	Nessus	Misc.	9/30/2026	11/9/2026	medium
351251	Linux Distros 未修补的漏洞：CVE-2026-102269	Nessus	Misc.	9/30/2026	11/9/2026	medium
351251	Linux Distros のパッチ未適用の脆弱性: CVE-2026-102269	Nessus	Misc.	9/30/2026	11/9/2026	medium
376262	SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:5064-1)	Nessus	SuSE Local Security Checks	11/5/2026	11/5/2026	critical
351251	Linux Distros Unpatched Vulnerability : CVE-2026-102269	Nessus	Misc.	9/30/2026	11/9/2026	medium
374968	Photon OS 5.0: Python3 PHSA-2026-5.0-92-1040	Nessus	PhotonOS Local Security Checks	11/2/2026	11/2/2026	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

critical

medium

critical