CVE-2026-48524
LOWPyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
Title source: cnaDescription
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8
Scores
CVSS v3
3.7
EPSS
0.0021
EPSS Percentile
10.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-460
CWE-755
Status
published
Products (3)
jpadilla/pyjwt
< 2.13.0
pyjwt_project/pyjwt
< 2.13.0
pypi/pyjwt
0 - 2.13.0PyPI
Published
May 28, 2026
Tracked Since
May 28, 2026