CVE-2026-101917

The PyJWT library (versions prior to 2.14.0 ) is vulnerable because the get_signing_key_from_jwt function lacks a negative cache or minimum refresh interval for unknown kid values. This allows an attacker to send unauthenticated tokens with unknown or varying kid values, forcing PyJWKClient to re...