CVE-2026-32597

PyJWT prior to 2.12.0 does not validate the crit header (RFC 7515 §4.1.11). If a JWS contains a crit array with extensions PyJWT cannot understand, the library accepts the token instead of rejecting it, violating the MUST requirement. This CVE affects PyJWT and is fixed in version 2.12.0. Remedia...

CVE-2026-48526

PyJWT (Python) prior to 2.13.0 did not validate the use of JSON Web Keys in HMAC verification, allowing an attacker to use the issuer public key as the HMAC secret during token verification. This could enable forging tokens when mixing RS/EC/JWK and HS algorithms. The issue is fixed in PyJWT 2.13...

CVE-2026-48524

CVE-2026-48524 affects PyJWT prior to 2.13.0. The issue is in PyJWKClient.get_signing_key(), which can force a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since the kid is from an unverified token header, an attacker can trigger unlimite...

CVE-2026-48522

PyJWKClient in PyJWT prior to 2.13.0 passes its uri argument directly to urllib.request.urlopen(), allowing attacker-controlled jku URLs to trigger SSRF and related token-forgery scenarios via file://, ftp://, or data: schemes. Affected component: PyJWKClient (Python). Root cause: lack of a schem...

CVE-2026-102268

The PyJWT library (versions prior to 2.14.0 ) contains a vulnerability in jwt/utils.py where the is_pem_format function fails to recognize certain PEM representations accepted by the cryptography loader. This occurs when applications mixing HMAC and asymmetric algorithms provide mutated public-ke...

CVE-2026-102270

The PyJWT library (prior to version 2.14.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) in the is_pem_format function. The root cause is extensive backtracking performed by a lazy PEM regular expression when processing certificate-like inputs containing repeated BEGIN markers...

CVE-2026-101917

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a denial-of-service vector due to how it handles unknown keys in the get_signing_key_from_jwt function. Because the library lacks a negative cache or minimum refresh interval, repeated requests using unknown or varying kid value...

CVE-2026-102267

The PyJWT library (versions prior to 2.14.0 ) is vulnerable in the PyJWKClient component because it fails to revalidate redirect destinations against the JWKS trust boundary . An attacker who can influence a configured trusted JWKS endpoint's response can trigger a redirect, causing PyJWKClient t...

CVE-2026-102269

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a signature segment decoding issue. The library incorrectly accepts characters outside the canonical Base64URL representation, allowing non-Base64URL characters to be appended to a valid compact JWS signature segment. Because ba...