An update for python-jwt is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4386 Final 1.0 1.0 2026-10-16 Initial 2026-10-16 2026-10-16 openEuler SA Tool V1.0 2026-10-16 python-jwt security update An update for python-jwt is now available for openEuler-22.03-LTS-SP4 setup.py test %endif Security Fix(es): PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.(CVE-2026-102267) PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.(CVE-2026-102268) PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.(CVE-2026-102271) An update for python-jwt is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical python-jwt https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4386 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-102267 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-102268 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-102271 https://nvd.nist.gov/vuln/detail/CVE-2026-102267 https://nvd.nist.gov/vuln/detail/CVE-2026-102268 https://nvd.nist.gov/vuln/detail/CVE-2026-102271 openEuler-22.03-LTS-SP4 python-jwt-help-2.3.0-8.oe2203sp4.noarch.rpm python3-jwt-2.3.0-8.oe2203sp4.noarch.rpm python-jwt-2.3.0-8.oe2203sp4.src.rpm PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0. 2026-10-16 CVE-2026-102267 openEuler-22.03-LTS-SP4 High 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N python-jwt security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4386 PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0. 2026-10-16 CVE-2026-102268 openEuler-22.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N python-jwt security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4386 PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0. 2026-10-16 CVE-2026-102271 openEuler-22.03-LTS-SP4 High 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N python-jwt security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4386