What is CVE-2026-102269?

CVE-2026-102269 is a medium-severity vulnerability in Jpadilla Pyjwt, classified under CWE-180. CVSS score: 4.8/10. Published 2026-09-28.

How severe is CVE-2026-102269?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Vulnerability in Jpadilla Pyjwt

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.

Published 2026-09-28 · last modified 2026-09-29.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Jpadilla Pyjwt — versions < 2.14.0

Weakness classification (CWE)

CWE-180

References

Frequently asked questions

What is CVE-2026-102269?: CVE-2026-102269 is a medium-severity vulnerability in Jpadilla Pyjwt, classified under CWE-180. CVSS score: 4.8/10. Published 2026-09-28.
How severe is CVE-2026-102269?: Medium severity. CVSS v3 base score is 4.8 out of 10.