What’s Vulnerable › Vulnerabilities

CVE-2026-102267: PyJWT: PyJWKClient follows redirects when fetching JWKS

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-28 · updated 2026-10-07
• Weakness: CWE-200

Description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

Affected products

• jpadilla pyjwt: before 2.14.0 — fixed in 2.14.0

How to fix

Upgrade to a fixed version: jpadilla pyjwt 2.14.0. Check the vendor advisory for mitigations.

References

• https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj

Get alerted when CVE-2026-102267 or the next vulnerability affects your stack