PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

🗓️ 24 Jul 2026 08:01:37Reported by MicrosoftType

mscve🔗 msrc.microsoft.com👁 7 Views

PyJWKClient in PyJWT can trigger unlimited JWKS requests via attacker-controlled key id values, causing DoS.

Reporter	Title	Published	Views	Family All 122
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0	30 Jun 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in Watson Data Intelligence	18 Aug 202608:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in pyjwt-2.12.1-py3-none-any.whl	17 Jun 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	23 Jul 202613:08	–	ibm
IBM Security Bulletins	Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument	4 Aug 202609:56	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	30 Jun 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to PyJWT	15 Jul 202606:08	–	ibm
ATTACKERKB	CVE-2026-48524	28 May 202615:07	–	attackerkb

Vulners

Node

microsoft azl3_python-jwt_2.8.0-2Range<2.13.0-1

08 Aug 2026 08:40Current

5Medium risk

Vulners AI Score5

CVSS 3.13.7

EPSS0.00336

SSVC

python jwt jwks endpoint denial of service attacker key id