CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards.

Pyjwt

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted…

28. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-102267
• GitHub
  https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj