CVE-2026-48524 Details
Description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
A denial-of-service vulnerability has been identified in PyJWT versions through 2.12.1, specifically within the PyJWKClient component. The issue arises because the get_signing_key() method sends a new HTTP request to the JWKS endpoint for each JWT with an unrecognized kid value, without any rate limiting. Since the kid is sourced from the unverified token header, this behavior allows an attacker to generate unlimited outbound requests. The problem occurs only when a JWKS fetch fails, creating a dependency on the behavior of the upstream JWKS endpoint, such as rate limiting or transient errors. This vulnerability can lead to increased network latency and disrupt authentication processes by clearing the JWKS cache on fetch errors, causing a reliance on the next successful fetch to restore normal operation.
Users can upgrade to PyJWT version 2.13.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-460 | Improper Cleanup on Thrown Exception | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pyjwt project pyjwt | < 2.13.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |