{"vulnerability": "cve-2026-102275", "sightings": [{"uuid": "4095dcc8-bd88-4756-8068-b4b7d58b87e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102275", "type": "published-proof-of-concept", "source": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "content": "", "creation_timestamp": "2026-09-23T19:17:22.000000Z"}, {"uuid": "70c06054-6024-4d92-99c8-08ddaa952b0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102275", "type": "seen", "source": "https://gist.github.com/alon710/244134758ad2d56dbcbe79ab43a10253", "content": "# CVE-2026-102275: CVE-2026-102275: Public/Private Key Identity Confusion in PyJWT OKP JWK Processing\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102275\n\n## Summary\nCVE-2026-102275 (GHSA-x33g-cr3x-6449) is a public/private key identity confusion vulnerability in PyJWT versions 2.1.0 through 2.14.0. When importing Octet Key Pair (OKP) JSON Web Keys (JWKs) representing Ed25519 or Ed448 curves, PyJWT fails to verify that the public parameter 'x' matches the private parameter 'd'. An attacker can construct a hybrid JWK combining a victim's public key with the attacker's private key. In protocols like DPoP that bind sessions via public key thumbprints, this allows the attacker to authenticate as the victim while signing proofs with their own private key, fully bypassing sender-constrained security guarantees.\n\n## TL;DR\nPyJWT fails to verify that the public and private parameters of an imported OKP (Ed25519/Ed448) JWK belong to the same key pair. This allows attackers to forge a hybrid key containing a victim's public key and their own private key, bypassing cryptographic token bindings such as DPoP.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-102275\n- **CWE ID**: CWE-345 (Insufficient Verification of Data Authenticity)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Primary Impact**: Authentication Bypass / Security Token Hijacking\n\n## Affected Systems\n\n- PyJWT\n- **pyjwt**: >= 2.1.0, < 2.15.0 (Fixed in: `2.15.0`)\n\n## Mitigation\n\n- Upgrade the pyjwt package to version 2.15.0 or higher.\n- Implement request-filtering middleware to reject JWKs in HTTP headers that contain the private key parameter 'd'.\n- Disable EdDSA and OKP algorithms in PyJWT decode routines if Ed25519/Ed448 are not actively used.\n\n**Remediation Steps:**\n1. Execute 'pip install --upgrade pyjwt>=2.15.0' in your project environment.\n2. Verify the installation using 'python -c \"import jwt; print(jwt.__version__)\"'.\n3. Inspect the application codebase for occurrences of 'OKPAlgorithm' or jwt decode configurations containing 'EdDSA'.\n4. Add explicit schema validation to clean client-supplied JWS headers prior to token signature validation.\n\n## References\n\n- [GitHub Security Advisory GHSA-x33g-cr3x-6449](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449)\n- [Fix Commit in GitHub Repository](https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c)\n- [PyJWT Release 2.15.0](https://github.com/jpadilla/pyjwt/releases/tag/2.15.0)\n- [NVD - CVE-2026-102275](https://nvd.nist.gov/vuln/detail/CVE-2026-102275)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-102275)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102275) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T13:30:31.000000Z"}]}