CVE-2026-48526
7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jpadilla | pyjwt | < 2.13.0 | affected |
Weaknesses
- CWE-287: CWE-287: Improper Authentication
- CWE-347: CWE-347: Improper Verification of Cryptographic Signature
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: total
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
Additional References
- https://access.redhat.com/security/cve/CVE-2026-48526
- https://bugzilla.redhat.com/show_bug.cgi?id=2482734
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json
- https://access.redhat.com/errata/RHSA-2026:34160
- https://access.redhat.com/errata/RHSA-2026:34365
- https://access.redhat.com/errata/RHSA-2026:25902
- https://access.redhat.com/errata/RHSA-2026:26206
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:25928
- https://access.redhat.com/errata/RHSA-2026:33683
- https://access.redhat.com/errata/RHSA-2026:30076
- https://access.redhat.com/errata/RHSA-2026:28571
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.