High severity · published May 28, 2026
CVE-2026-48526
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
7.4
CVSS
0.4%
EPSS
No
On KEV
Description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
pyjwt · jpadilla
< 2.13.0 · source: vendor, NVD
OL
OpenShift Lightspeed · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat AI Inference Server · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat AI Inference Server 3.3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.5 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.6 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48526
Exploit
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25902
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25928
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:26206
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:28571
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:30076
More from pyjwt
9.1
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
9.1
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS
9.1
CVE-2026-102266
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
8.2
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
7.5
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set