TI-2026-35884 Aliases CVE-2026-48524 GHSA-fhv5-28vv-h8m8

PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

LOW 18CWE-460Published 2026-05-28 · Updated 2026-05-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 12 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.004 34th percentileScored 2026-11-07

Fix Partial pyjwt (jpadilla): 2.13.0pyjwt (PyPI): 2.13.0Red Hat: 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jpadilla	pyjwt	before 2.13.0	2.13.0	Patch available	CNA
—	pyjwt (PyPI)	2.0.0 to before 2.13.0	2.13.0	Patch available	GHSA-fhv5-28vv-h8m8

pyjwt Vendorjpadilla Affected before 2.13.0 Fixed in 2.13.0 Patch available CNA
pyjwt (PyPI) Vendor— Affected 2.0.0 to before 2.13.0 Fixed in 2.13.0 Patch available GHSA-fhv5-28vv-h8m8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pyjwt_project:pyjwt::::::::	before 2.13.0	Vulnerable	jpadilla

cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* Versions before 2.13.0 Vulnerable ·jpadilla

Remediation

Fix · CNA pyjwt (jpadilla) Fixed in 2.13.0
Fix · GHSA-fhv5-28vv-h8m8 pyjwt (PyPI) Fixed in 2.13.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Migration Toolkit for Applications 8	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
Red Hat AI Inference Server	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Trusted Artifact Signer	Affected	No fix yet: Fix deferred
Red Hat Update Infrastructure 4 for Cloud Providers	Affected	No fix yet: Fix deferred

Not affected: 3 products

Red Hat AI Inference Server
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-48524
2026-10-03 Alias added: GHSA-fhv5-28vv-h8m8

References

Advisory 2

Other 3

TI-2026-65303 Improper signature verification in jpadilla pyjwt CVSS 3.1CRITICAL 9.1
TI-2026-65301 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVSS 3.1CRITICAL 9.1
TI-2026-65219 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse… CVSS 3.1HIGH 7.5
TI-2026-65218 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVSS 3.1HIGH 7.5
TI-2026-25107 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVSS 3.1HIGH 7.5
TI-2026-65310 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVSS 3.1HIGH 8.2

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences