Summary
It was discovered that PyJWT incorrectly handled certain URIs when using
PyJWKClient. A remote attacker could possibly use this issue to perform
server-side request forgery (SSRF) or expose sensitive local files.
This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu
26.04 LTS. (CVE-2026-48522)
It was discovered that PyJWT incorrectly verified cryptographic signatures
when decoding tokens with PyJWK keys. A remote attacker could possibly
use this issue to bypass signature verification and forge valid JSON Web
Tokens. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-48523)
It was discovered that PyJWT incorrectly handled unknown key identifiers
in PyJWKClient. A remote attacker could possibly use this issue to cause
PyJWT to make excessive network requests, resulting in a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-48524)
It was discovered that PyJWT incorrectly handled payload decoding during
detached JWS token verification. A remote attacker could possibly use
this issue to cause PyJWT to consume excessive resources, resulting in
a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-48525)
It was discovered that PyJWT incorrectly validated JSON Web Keys when
decoding tokens with both HMAC and asymmetric algorithms enabled. A remote
attacker could possibly use this issue to forge valid tokens, resulting
in an authentication bypass. (CVE-2026-48526)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pyjwt | 2.3.0-1ubuntu0.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | pyjwt | 2.7.0-1ubuntu0.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | pyjwt | 2.10.1-4ubuntu1.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pyjwt | 1.3.0-1ubuntu0.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | pyjwt | 1.7.1-2ubuntu2.1+esm2 |
Vulnerabilities 5
-
High 7.4
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker t…
-
Medium 5.4
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied …
-
Medium 5.3
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enf…
-
Medium 4.2
PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and…
-
Low 3.7
PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token heade…