CVE-2026-48526
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
PyJWT library in Python prior to 2.13.0 does not validate the use of JSON Web Keys in HMAC algorithm, allowing an attacker to use the issuer's public key as the HMAC secret key.
Risk Assessment
An attacker can impersonate any user or JWT issuer, potentially leading to unauthorized access to systems and data.
Recommendation
Update PyJWT to version 2.13.0 or later.
Other vulnerabilities in PyJWT
See all- CVE-2017-11424High
In PyJWT versions 1.5.0 and below, the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format is allowed, enabling symmetric/asymmetric key confusion attacks.
- CVE-2026-32597High
PyJWT before version 2.12.0 does not validate the crit (Critical) Header Parameter defined in RFC 7515. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it, violating the MUST requirement in the RFC.
Original NVD description (English source)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.