CVE-2026-48523 Details
Description
PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.
A vulnerability exists in PyJWT versions 2.9.0 through 2.12.1, allowing a verifier-side algorithm allow-list bypass when decoding JSON Web Tokens (JWTs) with PyJWK keys. The issue arises because, while the JWT header's algorithm is checked against a caller-supplied allow-list, the actual signature verification uses the algorithm associated with the PyJWK object, not the header algorithm. This flaw enables an attacker controlling a registered JWK/JWKS private key to sign tokens with disallowed algorithms, bypassing server-side algorithm policies. The vulnerability affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow.
Users should upgrade to PyJWT version 2.13.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f | CISA-ADP | ExploitVendor Advisory |
| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyjwt project pyjwt | >= 2.9.0, < 2.13.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |