CVE-2026-102267
Critical
9.1 CVSS v3.1
- Published
- Sep 28, 2026
- Updated
- Oct 7, 2026
- Vendor
- Pyjwt Project
- Affected versions
- See affected products
- Weakness
- CWE-200, CWE-345, CWE-918
Summary
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
Severity
Critical (9.1)CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
- Pyjwt Project Pyjwt < 2.14.0
Exploitation status
Unknown
Technical details
Technical analysis has not been written for this record yet.
Mitigation & remediation
Follow the vendor advisory linked below for patches and workarounds.