The vulnerability is a CWE-347 flaw that allows a JSON Web Token forgery attack because PyJWT fails to normalize Unicode byte‑order marks in raw‑JWK detectors. When a public JWK is prefixed with a UTF‑8 BOM and used in a mixed‑algorithm verification path, the library treats the key as an HMAC secret, allowing an attacker who knows the public key to forge tokens. This flaw permits unauthenticated token creation, providing attackers with the ability to impersonate users or elevate privileges in applications that rely on JWT validation.

The issue affects pyjwt releases 2.13.0 through 2.14.0. The library’s HMACAlgorithm.prepare_key function is vulnerable until version 2.14.0, where the fix normalizes BOM characters. Systems using PyJWT to verify signed tokens and that supply public JWKs should ensure they are running a patched version.

The vulnerability carries a CVSS score of 7.4 and is not listed in the CISA KEV database. An attacker must know the public JWK and be able to supply it to a verification path that mixes algorithms; the lack of an available EPSS score makes it unclear how frequently it is exploited. This is a CWE-347 flaw, and the ability to forge valid authentication tokens represents a high‑impact attack vector, making the flaw a serious concern for applications that trust JWTs from external providers.