atlassian-jwt-auth (1.0.9), eve-auth-jwt (>=1.0.2, <=1.0.5) potentially affected by CVE-2026-48526 via pyjwt (1.3.0)

pyjwt PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth 1.0.9 - eve-auth-jwt =1.0.2, =1.0.5 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

more-jwtauth (0.7.0) potentially affected by CVE-2026-48526 via pyjwt (1.4.1)

pyjwt PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - more-jwtauth 0.7.0 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

django-googleauth-ng (>=2.1.0, <=2.3.0) potentially affected by CVE-2026-48526 via pyjwt (0.4.1)

pyjwt PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-googleauth-ng =2.1.0, =2.3.0 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-48526 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1596 more potentially affected by CVE-2026-48526 via pyjwt (>=2.0.0a2, <=2.12.1)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48526 Source advisory: GHSA-XGMM-8J9V-C9WX...

eve-auth-jwt (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-48526 via pyjwt (1.0.1)

pyjwt PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - eve-auth-jwt =1.0.0, =1.0.1 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-48526 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

mbq-tokens (0.0.1), twilio (>=6.4.2a1, <=6.5.0) potentially affected by CVE-2026-48526 via pyjwt (1.5.0)

pyjwt PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - mbq-tokens 0.0.1 - twilio =6.4.2a1, =6.5.0 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

atlassian-jwt-auth (>=2.0.0, <=2.6.0), clink (>=0.10.0, <=0.23.0) +7 more potentially affected by CVE-2026-48526 via pyjwt (1.4.0)

pyjwt PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.0.0, =0.10.0, =0.0.1.dev1, =0.0.1.dev3, =0.4.0, =3.1.0, =1.1.0, =0.8.0, =0.9.0 Source cves: CVE-2026-48526 Source advisory:...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +679 more potentially affected by CVE-2026-48526 via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-48526 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2026-48526 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

dbnd-datastage-monitor (>=1.0.4.1, <=1.0.4.3), dkcloudcommand (>=1.0.132rc1, <=1.1.270rc1) +5 more potentially affected by CVE-2026-48526 via pyjwt (1.6.1)

pyjwt PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - dbnd-datastage-monitor =1.0.4.1, =1.0.132rc1, =0.2.1, =0.1.1rc0, =0.5.3, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-48526 Source advisory:...

360solutions-bc-mcp (>=0.5.3, <=0.5.6), a-beta-scalekit (>=2.3.0, <=4.0.2) +633 more potentially affected by CVE-2026-48523 via pyjwt (>=2.9.0, <=2.12.1)

pyjwt PYPI version =2.9.0, =0.5.3, =2.3.0, =1.1.0rc1, =1.0.1, =2.4.2rc9, =1.2.0, =0.1.1, =3.0.0, =0.1.31, =0.1.0, =1.5.0a9, =0.5.0rc4, =1.405.15, =1.420.4 and more Source cves: CVE-2026-48523 Source advisory: GHSA-JQ35-7PRP-9V3F...

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

!NOTE Scored assuming a deployment where algorithm policy functions as an authentication/authorization boundary. In deployments where the algorithm policy enforces crypto agility only, the practical confidentiality impact is lower and the issue is closer to an integrity-of-policy-enforcement bug...

360solutions-bc-mcp (>=0.5.3, <=0.5.6), a-beta-scalekit (>=2.3.0, <=4.0.2) +633 more potentially affected by CVE-2026-48523 via pyjwt (>=2.9.0, <=2.12.1)

pyjwt PYPI version =2.9.0, =0.5.3, =2.3.0, =1.1.0rc1, =1.0.1, =2.4.2rc9, =1.2.0, =0.1.1, =3.0.0, =0.1.31, =0.1.0, =1.5.0a9, =0.5.0rc4, =1.405.15, =1.420.4 and more Source cves: CVE-2026-48523 Source advisory: OSV:GHSA-JQ35-7PRP-9V3F...

GHSA-JQ35-7PRP-9V3F PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

!NOTE Scored assuming a deployment where algorithm policy functions as an authentication/authorization boundary. In deployments where the algorithm policy enforces crypto agility only, the practical confidentiality impact is lower and the issue is closer to an integrity-of-policy-enforcement bug...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1539 more potentially affected by CVE-2026-48524 via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48524 Source advisory: GHSA-FHV5-28VV-H8M8...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1539 more potentially affected by CVE-2026-48524 via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48524 Source advisory: OSV:GHSA-FHV5-28VV-H8M8...

Important: Red Hat Security Advisory: fence-agents security update

An update for fence-agents is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...