Critical severity · published Sep 28, 2026
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
pyjwt · jpadilla
< 2.14.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102267
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj
x_refsource_MISC
https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
More from pyjwt
9.1
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
9.1
CVE-2026-102266
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
8.2
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
7.5
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
7.5
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)