CVE-2026-48526
published 2026-05-28CVE-2026-48526: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC…
PriorityP347high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.40%
32.3th percentile
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Affected
81 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-26 | mcp-tools-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | mcp-tools-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| fence-agents | fence-agents | — | — |
| jpadilla | pyjwt | < 2.13.0 | 2.13.0 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
jpadilla pyjwt up to 2.12.x JSON Web Token improper authentication (GHSA-xgmm-8j9v-c9wx / Nessus ID 321094)
vuldb·2026-06-16·CVSS 7.4
CVE-2026-48526 [HIGH] jpadilla pyjwt up to 2.12.x JSON Web Token improper authentication (GHSA-xgmm-8j9v-c9wx / Nessus ID 321094)
A vulnerability was found in jpadilla pyjwt up to 2.12.x. It has been classified as critical. This issue affects some unknown processing of the component JSON Web Token Handler. Performing a manipulation results in improper authentication.
This vulnerability is reported as CVE-2026-48526. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
ghsa·2026-06-15
CVE-2026-48526 [HIGH] CWE-287 PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
> [!NOTE]
> Exploitation requires a verifier configured with both symmetric and asymmetric algorithms in `algorithms=[…]` and a raw-JSON JWK as the `key=` argument, both contrary to documented usage, hence the High attack-complexity rating.
### Summary
When the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm.
### Details
In JWT algorithm confusion attack, the verifier is mistakenly use of public key to be used as the shared secret in symmetric algorithms.
In pyjwt case, when the verifier
Red Hat
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
vendor_redhat·2026-05-28·CVSS 7.4
CVE-2026-48526 [HIGH] CWE-347 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to
No detection rules found.
No public exploits indexed.
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wxhttps://access.redhat.com/errata/RHSA-2026:25902https://access.redhat.com/errata/RHSA-2026:25928https://access.redhat.com/errata/RHSA-2026:26206https://access.redhat.com/errata/RHSA-2026:28571https://access.redhat.com/errata/RHSA-2026:30076https://access.redhat.com/errata/RHSA-2026:30088https://access.redhat.com/errata/RHSA-2026:30089https://access.redhat.com/errata/RHSA-2026:33683https://access.redhat.com/errata/RHSA-2026:34160https://access.redhat.com/errata/RHSA-2026:34365https://access.redhat.com/errata/RHSA-2026:34374https://access.redhat.com/errata/RHSA-2026:35835https://access.redhat.com/errata/RHSA-2026:35836https://access.redhat.com/errata/RHSA-2026:35837https://access.redhat.com/errata/RHSA-2026:35845https://access.redhat.com/errata/RHSA-2026:36350https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:40967https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:42132https://access.redhat.com/errata/RHSA-2026:42142https://access.redhat.com/errata/RHSA-2026:42144https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/errata/RHSA-2026:48085https://access.redhat.com/security/cve/CVE-2026-48526https://bugzilla.redhat.com/show_bug.cgi?id=2482734https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json
2026-05-28
Published