CVE-2026-102267

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...