CVE-2026-102267

PyJWT: PyJWKClient follows redirects when fetching JWKS

State: Published
Severity: 7.4 High
Published: Sep 28, 2026
Updated: Oct 1, 2026
Reserved: Sep 28, 2026

Description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-345 Insufficient Verification of Data Authenticity
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
pyjwtjpadilla	< 2.14.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.