CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS
Attackers can exploit redirect handling in PyJWKClient to disclose credentials or substitute verification keys when trusted endpoints return malicious redirects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102267?
CVE-2026-102267 is a high-severity server-side request forgery vulnerability in jpadilla pyjwt, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
Which versions are affected by CVE-2026-102267?
3 open source packages ship an affected version, including pyjwt and PyJWT. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyjwt PyPI | All versions | 2.14.0 |
pyjwt PyPI | All versions | 2.14.0 |
PyJWT PyPI | All versions | 2.14.0 |
Products include Pyjwt Project Pyjwt.
How do I fix CVE-2026-102267?
Upgrade pyjwt to 2.14.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-102267 being exploited?
There is no known exploitation of CVE-2026-102267 in the wild and no public exploit code.
Other vulnerabilities in jpadilla pyjwt
- CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
- CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
- CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
- CVE-2026-102272 PyJWT BOM Bypass
Sources
Also known as AZL-104979, CLEANSTART-2026-GM98203, CLEANSTART-2026-IE39566, DEBIAN-CVE-2026-102267, ECHO-669e-7f60-f638, GHSA-9v7f-9g4p-ffgj and 28 more.