Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jpadilla | pyjwt | < 2.14.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pyjwt | 2.14.0-1 | — |
| Debian 13 | pyjwt | No fix yet | — |
| Debian 12 | pyjwt | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pyjwt | 2.13.0-1ubuntu1 | USN-8916-2 |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.2 | USN-8916-1 |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.3 | USN-8916-1 |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.5 | USN-8916-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm3 | USN-8916-1 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm3 | USN-8916-1 |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm3 | USN-8916-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | fence-virt +55 | 4.16.0-21.el10_2.7 | RHSA-2026:98612, RHSA-2026:94501 |
| RHEL 9 | fence-virt +56 | 4.10.0-110.el9_8.8 | RHSA-2026:98503, RHSA-2026:94500 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.26-1.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Utils 6 | rubygem-hammer_cli_foreman | 3.18.3-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite Utils 6 | rubygem-http-cookie | 1.1.6-2.el9sat | RHSA-2026:100120 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.19.6-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite Maintenance 6 | ansible-core | 1:2.16.19-4.el9sat | RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Capsule 6 | ansible-core +1 | 1:2.16.19-4.el9sat | RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Capsule 6 | createrepo_c +2 | 1.2.6-1.el9pc | RHSA-2026:100120 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.26-1.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.26.9-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.49.39-5.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pyjwt +2 | 2.15.1-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python-pysequoia +1 | 0.1.35-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite Capsule 6 | python3.12-pulp-container | 2.26.19-2.el9pc | RHSA-2026:100120 |
| Red Hat Satellite Capsule 6 | python3.12-pulp-rpm | 3.29.12-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | python3.12-pulpcore | 3.73.45-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.15.1-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | python3.12-pysequoia | 0.1.35-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite Capsule 6 | rubygem-http-cookie | 1.1.6-2.el9sat | RHSA-2026:100120 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_container_gateway | 3.5.1-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_dynflow | 0.9.3-2.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite Capsule 6 | satellite +3 | 6.19.6-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | ansible-core +1 | 1:2.16.19-4.el9sat | RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | candlepin +1 | 4.4.26-2.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | createrepo_c +2 | 1.2.6-1.el9pc | RHSA-2026:100120 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.26-1.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.26.9-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pulpcore +1 | 3.49.39-5.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pyjwt +2 | 2.15.1-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python-pysequoia +1 | 0.1.35-1.el8pc | RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | python3.12-pulp-container | 2.26.19-2.el9pc | RHSA-2026:100120 |
| Red Hat Satellite 6 | python3.12-pulp-rpm | 3.29.12-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite 6 | python3.12-pulpcore | 3.73.45-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.15.1-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite 6 | python3.12-pysequoia | 0.1.35-1.el9pc | RHSA-2026:100120, RHSA-2026:99952 |
| Red Hat Satellite 6 | rubygem-crass | 1.0.8-1.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | rubygem-foreman_ansible | 17.0.5-2.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-foreman_remote_execution +1 | 16.5.3-3.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-foreman_rh_cloud | 13.2.12-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-foreman_theme_satellite | 16.2.5-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman | 3.18.3-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-http-cookie | 1.1.6-2.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-katello | 4.14.0.24-1.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | rubygem-puma | 6.4.3-2.el8sat | RHSA-2026:99952, RHSA-2026:99950, RHSA-2026:99949 |
| Red Hat Satellite 6 | rubygem-safemode | 1.5.0-3.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | rubygem-smart_proxy_container_gateway | 3.5.1-1.el9sat | RHSA-2026:100120 |
| Red Hat Satellite 6 | rubygem-smart_proxy_dynflow | 0.9.3-2.el8sat | RHSA-2026:100120, RHSA-2026:99952, RHSA-2026:99950 |
| Red Hat Satellite 6 | satellite +3 | 6.19.6-1.el9sat | RHSA-2026:100120 |
| RHEL 10.0 EUS | fence-virt +55 | 4.16.0-5.el10_0.14 | RHSA-2026:95012 |
| RHEL 9.6 EUS | fence-virt +56 | 4.10.0-86.el9_6.23 | RHSA-2026:94523 |
| RHEL 9.4 E4S | fence-virt +56 | 4.10.0-62.el9_4.31 | RHSA-2026:94557 |
| RHEL 9.2 E4S | fence-virt +56 | 4.10.0-43.el9_2.27 | RHSA-2026:94634 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.6.20261019-1.el9ap | RHSA-2026:87004 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.15-1.el9ap | RHSA-2026:87004 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.71-1.el9ap | RHSA-2026:87004 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.14.0-1.el9ap | RHSA-2026:87004 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | fence-virt +54 | 4.16.0-21.el10_2.7 | ALSA-2026:94501 |
| AlmaLinux 9 | fence-virt +36 | 4.10.0-110.el9_8.8 | ALSA-2026:94500 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | fence-agents | 4.16.0-21.el10_2.7 | RLSA-2026:94501 |
| Rocky Linux 10 | fence-virt +54 | 4.16.0-34.el10_3.1 | RLSA-2026:98612 |
| Rocky Linux 9 | fence-agents | 4.10.0-110.el9_8.8 | RLSA-2026:94500 |
| Rocky Linux 9 | fence-virt +55 | 4.10.0-122.el9_9.1 | RLSA-2026:98503 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 15 SP5 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 15 SP4 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 3 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-PyJWT | 2.12.1-160000.3.1 | SUSE-SU-2026:24219-1 |
| SLES for SAP 15 SP6 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES for SAP 15 SP5 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES for SAP 15 SP4 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 16.0 | python-PyJWT | 2.12.1-160000.3.1 | SUSE-SU-2026:24219-1 |
| SLE Micro 6.2 | python-PyJWT | 2.12.1-160000.3.1 | SUSE-SU-2026:24126-1 |
| SLE Micro 6.1 | python-PyJWT | 2.12.1-slfo.1.1_3.1 | SUSE-SU-2026:24377-1 |
| SLE Micro 6.0 | python-PyJWT | 2.9.0-159998.1.1 | SUSE-SU-2026:24134-1 |
| SLE HPC 15 SP5 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLE HPC 15 SP4 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.3.1 | openSUSE-SU-2026:22074-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-jwt +1 | 2.4.0-1.amzn2023.0.6 | ALAS2023-2026-3298 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-jwt | 2.15.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | fence-virt +52 | 4.16.0-21.el10_2.7 | ELSA-2026-94501 |
| Oracle Linux 9 | fence-virt +54 | 4.10.0-110.el9_8.8 | ELSA-2026-94500 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r26 | — |
| Wolfi rolling | datadog-agent-7.78-core-integrations | No fix yet | — |
| Wolfi rolling | datadog-agent-7.79-core-integrations | 7.79.2-r20 | — |
| Wolfi rolling | datadog-agent-7.80-core-integrations | 7.80.4-r19 | — |
| Wolfi rolling | datadog-agent-7.81-core-integrations | 7.81.3-r8 | — |
| Wolfi rolling | ggshield | 1.55.0-r1 | — |
| Wolfi rolling | kserve-storage-controller | 0.21.0-r1 | — |
| Wolfi rolling | open-webui | 0.11.4-r1 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.30.1-r1 | — |
| Wolfi rolling | semgrep | 1.178.0-r6 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r17 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyjwt | < 2.14.0 | 2.14.0 | GHSA-9v7f-9g4p-ffgj |
Advisories 31
- RHSA-2026:99952 Red Hat Security Advisory: Satellite 6.18.11 Async Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:99949 Red Hat Security Advisory: Satellite 6.16.15 Async Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:99950 Red Hat Security Advisory: Satellite 6.17.13 Async Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:98503 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:95012 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:94634 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:94557 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:94523 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:94501 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:94500 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:87004 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- RHSA-2026:100120 Red Hat Security Advisory: Satellite 6.19.6 Async Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98612 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98612 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98503 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4111 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:94500 Critical: fence-agents security update AlmaLinux Security Advisories · Nov 4, 2026
- ALSA-2026:94501 Critical: fence-agents security update AlmaLinux Security Advisories · Nov 4, 2026
- RLSA-2026:94500 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 4, 2026
- RLSA-2026:94501 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 4, 2026
- SUSE-SU-2026:5064-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Nov 3, 2026
- ELSA-2026-94500 Critical: fence-agents security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- ELSA-2026-94501 Critical: fence-agents security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- SUSE-SU-2026:24377-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 27, 2026
- USN-8916-1 pyjwt vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-8916-2 pyjwt vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- ALAS2023-2026-3298 Important: python-jwt security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- SUSE-SU-2026:24219-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 21, 2026
- openSUSE-SU-2026:22074-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 19, 2026
- SUSE-SU-2026:24134-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:24126-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 13, 2026