CVE-2026-102274 is a Medium (CVSS 5.9) flaw in PyJWT from 2.9.0. One malformed RSA key in a JWK Set aborts construction of the whole set, which can cause authentication failures. The record says it is fixed in 2.14.0, but the GitHub advisory showed no patched version.
What's affected
The weakness is CWE-755 (improper handling of exceptional conditions). The record says PyJWT from 2.9.0 until 2.14.0 is affected and fixed in 2.14.0. The GitHub advisory lists affected versions as 2.9.0 through 2.13.0, and when we reviewed it, its patched versions field said none.
These two disagree on fix status. The record's description and a release link point to 2.14.0 as the fixed version, but the advisory page we saw had not been updated with a patched version. Treat 2.14.0 as the target and confirm on the release notes.
The cause is in key set parsing. PyJWKSet builds a list of keys and skips members that raise the library's own error types. But the RSA key import can raise a plain ValueError for malformed components, and that is not caught by the per-key handling. One bad member then stops the whole set from loading, even when the other keys are fine. The advisory says it confirmed the behaviour across releases from 2.9.0 through 2.13.0 and did not check earlier ones.
How to check if you're exposed
Check the version.
pip show pyjwt
Releases from 2.9.0 up to 2.13.0 are in scope. Then think about where your key sets come from. If you fetch a JWKS from a provider you trust, a malformed key is unlikely but possible, for example during a key rotation mistake on their side. If your service accepts key sets from tenants or from less trusted sources, the exposure is larger.
Look at your logs for sudden authentication failures that begin when a provider rotates keys, since that is how this bug would appear in real life.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Upgrade PyJWT to 2.14.0 or later and confirm on the release notes that the fix is included.
- Wrap key set loading in your own error handling so a bad key set falls back to the last good copy.
- Cache the last known good key set with a sensible lifetime.
- Alert on authentication failure spikes after JWKS refreshes.
- Review any code path that accepts key sets from tenants or third parties.
Why it matters
One bad entry taking down a whole list is a reliability and a security problem. If the verifier cannot load keys, valid users cannot sign in. Under attack, a party that can influence a key set can turn that into a targeted lockout.
The real exposure depends on who controls the key set. The record does not mark the CVE as known exploited. The severity is Medium because the effect is on availability.
Quick check
Why do the record and the advisory disagree on the fix?
The record says 2.14.0 fixes it. The advisory page showed no patched version when we reviewed it. Use 2.14.0 and confirm in the release notes.
Is this about forged tokens?
No. It is about a parse failure that can block valid logins, not about accepting invalid tokens.
Sources
Last reviewed: 18 October 2026.
