## PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

- 種別: advisory
- 重大度: high
- 関連技術: python
- 公開日時: 2026-10-22T15:48:04.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pxh4-856f-4h89)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pxh4-856f-4h89

影響: pip:pyjwt <= 2.13.0 → 2.14.0
HMACAlgorithm.from_jwk accepts a symmetric (kty=oct) JWK whose k value is the empty string and returns a zero-length key without raising. When a token is then verified with that key object (a PyJWK, or a PyJWK resolved by PyJWKSet / PyJWKClient), the HMAC verifier computes HMAC(key=b"", signing_input) and accepts any token an attacker forged with the same empty key. The attacker needs no secret knowledge: they reproduce the digest locally with an empty key and set the token's kid to the empty-k…