High severity · published Sep 28, 2026
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
pyjwt · jpadilla
< 2.14.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101917
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101917
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q
x_refsource_MISC
https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
More from pyjwt
9.1
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
9.1
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS
9.1
CVE-2026-102266
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
8.2
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
7.5
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set