CVE-2026-48524

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) PyJWT es una implementación de JSON Web Token en Python. Antes de la versión 2.13.0, PyJWKClient.get_signing_key() fuerza una nueva solicitud HTTP al endpoint JWKS para cada JWT con un valor kid desconocido, sin limitación de tasa. Dado que kid proviene del encabezado del token no verificado, un atacante puede desencadenar solicitudes salientes ilimitadas. La vulnerabilidad solo se manifiesta cuando una obtención de JWKS falla; un atacante puede intentar provocar eso con tráfico sostenido de kid desconocido, pero el resultado depende del comportamiento del endpoint JWKS ascendente (limitación de tasa, errores transitorios) lo cual está fuera del control del atacante. Esta vulnerabilidad está corregida en la versión 2.13.0.

Information

Published : 2026-05-28 16:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-48524

Mitre link : CVE-2026-48524

CVE.ORG link : CVE-2026-48524

JSON object : View

Products Affected

pyjwt_project

pyjwt

CWE

CWE-460

Improper Cleanup on Thrown Exception

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2026-48524", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48524", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T19:16:33.339327Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jpadilla", "product": "pyjwt", "versions": [{"status": "affected", "version": "< 2.13.0"}]}]}], "published": "2026-05-28T16:16:29.403", "references": [{"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-460"}, {"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0."}, {"lang": "es", "value": "PyJWT es una implementaci\u00f3n de JSON Web Token en Python. Antes de la versi\u00f3n 2.13.0, PyJWKClient.get_signing_key() fuerza una nueva solicitud HTTP al endpoint JWKS para cada JWT con un valor kid desconocido, sin limitaci\u00f3n de tasa. Dado que kid proviene del encabezado del token no verificado, un atacante puede desencadenar solicitudes salientes ilimitadas. La vulnerabilidad solo se manifiesta cuando una obtenci\u00f3n de JWKS falla; un atacante puede intentar provocar eso con tr\u00e1fico sostenido de kid desconocido, pero el resultado depende del comportamiento del endpoint JWKS ascendente (limitaci\u00f3n de tasa, errores transitorios) lo cual est\u00e1 fuera del control del atacante. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.13.0."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2692B308-E3F9-4586-AD28-F64C14358242", "versionEndExcluding": "2.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}