PyJWT is a Python implementation of JSON Web Token standards. Before version 2.14.0, the function that detects a PEM format was incomplete, allowing certain public‑key PEMs to be misidentified as raw HMAC secrets. The flaw permits an attacker who knows the public key to craft a token signed with a bogus HMAC secret that the library accepts as a valid key, effectively forging authenticated tokens. This results in a complete authentication bypass and possibilites arbitrary data tampering, classified as CWE‑347.

The vulnerability affects the jpadilla:pyjwt library in all releases prior to 2.14.0. Users employing any earlier version which mixes HMAC and asymmetric algorithms or supplies a mistakenly altered PEM key as the secret are impacted. The fix is issued in 2.14.0 and later releases.

The CVSS score of 9.1 reflects a high‑severity risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack vector is not explicitly stated, but since JSON Web Tokens are transmitted between client and server, a remote attacker could achieve token forgery by providing the public key and mutating it to bypass the guard ( the likely attack vector is remote). The recommendation is to apply the vendor patch, enforce correct key usage and apply a temporary validation filter if a delay is unavoidable.