CVE-2026-48524 PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
Attackers can cause denial of service by forcing unlimited outbound requests to JWKS endpoints using unknown key IDs in JWT headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48524?
CVE-2026-48524 is a low-severity denial of service vulnerability in jpadilla pyjwt, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Which versions are affected by CVE-2026-48524?
3 open source packages ship an affected version, including pyjwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyjwt PyPI | All versions | 2.13.0 |
pyjwt PyPI | From 2.0.0 | 2.13.0 |
pyjwt PyPI | From 2.0.0 | 2.13.0 |
Products include Pyjwt Project Pyjwt.
How do I fix CVE-2026-48524?
Upgrade pyjwt to 2.13.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48524 being exploited?
There is no known exploitation of CVE-2026-48524 in the wild and no public exploit code.
Other vulnerabilities in jpadilla pyjwt
- CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
- CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
- CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS
- CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Sources
Also known as AZL-93027, BELL-CVE-2026-48524, CLEANSTART-2026-QN15883, DEBIAN-CVE-2026-48524, ECHO-5526-5e92-5565, GHSA-fhv5-28vv-h8m8 and 31 more.