CVE-2026-48524
published 2026-05-28CVE-2026-48524: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every…
PriorityP419low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.34%
26.2th percentile
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Affected
73 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | mcp-tools-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| fence-agents | fence-agents | — | — |
| jpadilla | pyjwt | < 2.13.0 | 2.13.0 |
| llvm | llvm | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| openshift-lightspeed | lightspeed-to-dataverse-exporter-rhel9 | — | — |
| pyjwt_project | pyjwt | < 2.13.0 | 2.13.0 |
| pyjwt_project | pyjwt | >= 0 < 2.13.0 | 2.13.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
ghsa·2026-06-15
CVE-2026-48524 [LOW] CWE-460 PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
> [!NOTE]
> The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.
## Summary
PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.
Additionally, fetch_data() finally block clears the JWKS cache on network e
Red Hat
python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs
vendor_redhat·2026-05-28·CVSS 3.7
CVE-2026-48524 [LOW] CWE-770 python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs
python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. A remote attacker can exploit this vulnerability by sending specially crafted JWTs with unknown 'kid' (key ID) values. This can force the `PyJWKClient.get_signing_key()` function to make an unlimited number of unrate-limited HTTP requests to the JSON Web Key Set (JWKS) endpoint. This could potentially lead to a denial of service against the JWKS endpoint, depending on its rate limiting and error handling capabilities.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread
No detection rules found.
No public exploits indexed.
2026-05-28
Published