QSN-8916-1: PyJWT vulnerabilities
2026-10-13

Summary:
Several security issues were fixed in PyJWT.

Details:
YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forge authentication tokens. This issue only affected  Ubuntu
26.04 LTS. (CVE-2026-102266)

Rohan Das discovered that PyJWT incorrectly handled redirects when fetching
key sets. A remote attacker could possibly use this issue to  cause PyJWT
to disclose sensitive information. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS. (CVE-2026-102267)

It was discovered that PyJWT incorrectly recognized certain PEM
representations. An attacker who knew the public key could possibly use
this issue to forge authentication tokens. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu
26.04 LTS. (CVE-2026-102268)

Nuno Lopes discovered that PyJWT incorrectly handled DER public keys when
performing HMAC verification. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102271)

It was discovered that PyJWT did not properly handle certain JWK keys
prefixed with a byte-order mark. An attacker who knew the public key could
possibly use this issue to forge authentication tokens. (CVE-2026-102272)

Charles Vosburgh discovered that PyJWT incorrectly handled certain JWK
containers when performing HMAC verification. An attacker who knew the
public key could possibly use this issue to forge authentication tokens.
(CVE-2026-102273)

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-jwt 2.3.0-1ubuntu0.6 (fixed in 2.3.0-1ubuntu0.5)
  6.9.0.464 jammy: python3-jwt 2.3.0-1ubuntu0.5 (fixed in 2.3.0-1ubuntu0.5)
  6.8.6.015 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)
  6.8.5.018 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)
  6.8.4.038 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)
  6.8.3.018 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)
  6.8.2.002 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)
  6.8.1.007 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)
  6.8.0.205 jammy: python3-jwt 2.3.0-1ubuntu0.3 (fixed in 2.3.0-1ubuntu0.5)

CVEs: CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, CVE-2026-102266, CVE-2026-102273, CVE-2026-102272

References:
  https://ubuntu.com/security/notices/USN-8916-1