Repository navigation
Upgrade PyJWT 2.13.0 → 2.14.0 (6 CVEs) #522
Description
Sub-issue of #519 (P0 — auth bypass / token forgery). Surfaced by the Conductor OSS CVE scan (target python-sdk).
Upgrade PyJWT 2.13.0 → 2.14.0 clears:
- CVE-2026-102268 (critical)
- CVE-2026-102266 — auth bypass via empty HMAC key acceptance
- CVE-2026-102267 — verification key substitution via unvalidated JWKS redirects
- CVE-2026-102271 — auth bypass via DER public keys accepted as HMAC secrets
- CVE-2026-102272 — token forgery via Unicode BOM handling
- CVE-2026-102273 — token forgery via public JWK containers as HMAC secrets
Activity