Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2026-102267: PyJWT may accept forged keys from altered web address
CVE-2026-102267 · published 18 days ago
Summary
The PyJWT Python library can be misled when it follows a web redirect from a trusted key source to another location that isn’t checked. An attacker could supply their own key, causing sensitive credentials to be exposed or allowing fake keys to be used for verification. Upgrade to PyJWT version 2.14.0 or later to stop following redirects and protect your application.
What to do
- Update pyjwt to version 2.14.0.
- Update debian pyjwt to version 2.14.0-1.
- Update pyjwt to version 2.13.0+aikido.1.
- Update pyjwt_project pyjwt to version 2.14.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | jpadilla | pyjwt | < 2.14.0 |
| pip | – | pyjwt |
<= 2.13.0 Fix: upgrade to 2.14.0
|
| Ubuntu:Pro:16.04:LTS | canonical | pyjwt | All versions |
| PyPI | – | pyjwt |
< 2.14.0 Fix: upgrade to 2.14.0
|
| Debian:12 | debian | pyjwt | All versions |
| – | pyjwt_project | pyjwt |
< 2.14.0 cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* |
| Debian:14 | debian | pyjwt |
< 2.14.0-1 Fix: upgrade to 2.14.0-1
|
| Root:PyPI | – | pyjwt |
< 2.13.0+aikido.1 Fix: upgrade to 2.13.0+aikido.1
|
Original advisory text
PyJWT: PyJWKClient follows redirects when fetching JWKS
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1022... Vendor Advisory
- https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e5... Patch
- https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 URL
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102267 Vendor Advisory
- https://github.com/advisories/GHSA-9v7f-9g4p-ffgj
- https://ubuntu.com/security/CVE-2026-102267 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102267 Third Party Advisory
- https://github.com/jpadilla/pyjwt Product
- https://security-tracker.debian.org/tracker/CVE-2026-102267 Vendor Advisory
- https://pypi.org/project/pyjwt Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-200Information Exposure
CWE-345Insufficient Verification of Data Authenticity
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published28 Sep 2026
Updated15 Oct 2026
First seen28 Sep 2026
Sources
CVE-2026-102267 · NVD
CVE-2026-102267 · MITRE
CVE-2026-102267 · OSV
GHSA-9v7f-9g4p-ffgj · GHSA
UBUNTU-CVE-2026-102267 · OSV
GHSA-9v7f-9g4p-ffgj · OSV
DEBIAN-CVE-2026-102267 · OSV
PYSEC-2026-4144 · OSV
Track software like this
Free during beta