CVE-2026-101918

The PyJWT library (versions 2.0.0a1 to 2.15.0 ) contains a vulnerability in PyJWKClient.get_signing_key_from_jwt when verify_signature=False . The root cause is that the payload parser catches ValueError but fails to handle RecursionError during json.loads when processing an attacker-controlled, ...