PyJWT accepts empty HMAC keys, bypassing empty-key validation when a trusted JWK Set contains an oct entry with an empty k value. This allows an attacker to sign an HMAC token with a zero‑length key that PyJWT will accept, enabling the creation of forged tokens carrying arbitrary authenticated claims. The vulnerability is classified as CWE‑347 and can lead to unauthorized access and privilege escalation by impersonating legitimate users.

The affected product is PyJWT, maintained by jpadilla. Versions from 2.13.0 up to (but not including) 2.14.0 are vulnerable. The issue was resolved in release 2.14.0, so any installation using an earlier 2.13.x version is at risk.

The CVSS score is 7.4, indicating a high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. A potential attacker must be able to supply or tamper with a trusted JWK Set containing an oct key with an empty k value, and then sign a token with a zero‑length key. Once the token is accepted, the attacker can impersonate any user, bypass authentication and potentially gain elevated privileges. The exploit requires only that the application rely on PyJWT to validate tokens from the affected JWK Set, so deployments that use such JWKs are at significant risk.