CVE-2026-102267CWE-200CWE-345CWE-918information-disclosuressrf

CVE-2026-102267

High · published September 29, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-345 · Insufficient Verification of Data Authenticity; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-29T01:17Z
Affected products (1)
ProductVersionsFixed in
pyjwt_project/pyjwt< 2.14.02.14.0
References (3)
https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56 · [email protected]https://github.com/jpadilla/pyjwt/releases/tag/2.14.0 · [email protected]https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 20:23Z
    PyJWT: PyJWKClient follows redirects when fetching JWKS
    cvelistv5