{"id":"CVE-2026-48526","title":"PyJWT is a JSON Web Token implementation in Python","summary":"PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorith…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287","CWE-347"],"vendor":"pyjwt_project","product":"pyjwt","affected":["pyjwt < 2.13.0"],"patched":["pyjwt 2.13.0"],"published":"2026-05-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:19.447","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:25902","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26206","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28571","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30076","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33683","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34160","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34365","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34374","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35835","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35836","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35837","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35845","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36350","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40967","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42132","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42142","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42144","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50222","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50223","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50263","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50319","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50336","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50904","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526"},{"url":"https://github.com/jpadilla/pyjwt"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-179.yaml"},{"url":"https://access.redhat.com/errata/RHSA-2026:69466"},{"url":"https://access.redhat.com/errata/RHSA-2026:69467"},{"url":"https://access.redhat.com/errata/RHSA-2026:69469"},{"url":"https://access.redhat.com/errata/RHSA-2026:69464"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","osv","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-05-29T03:55:56.833915Z"},"epss":0.00395,"epssPercentile":0.33518,"ingestedAt":"2026-07-02T15:38:24.975Z","aliases":["GHSA-xgmm-8j9v-c9wx","PYSEC-2026-179"],"ecosystem":"pip","slug":"CVE-2026-48526","body":"## Overview\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.\n\n## Affected\n\n- `pyjwt < 2.13.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pyjwt 2.13.0`\n\n## Vendor advisories\n\n- **RHSA-2026:50319** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50319)\n- **RHSA-2026:50223** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50223)\n- **RHSA-2026:50336** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50336)\n- **RHSA-2026:34160** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34160)\n- **RHSA-2026:50222** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50222)\n- **RHSA-2026:50263** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50263)\n- **RHSA-2026:34365** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34365)\n- **RHSA-2026:35845** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35845)\n- **RHSA-2026:25902** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:25902)\n- **RHSA-2026:35837** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux High Availability E4S (v.9.2), Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35837)\n- **RHSA-2026:35836** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux High Availability E4S (v.9.4), Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35836)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json)\n\n## Package advisory (CVE-2026-48526)\n\nAffected packages:\n\n- `pyjwt < 2.13.0`\n\nPatched in:\n\n- `pyjwt 2.13.0`\n\nSource: https://osv.dev/vulnerability/GHSA-xgmm-8j9v-c9wx","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201700,"id":"CVE-2026-48526","ts":1789399626808,"field":"exploit_available","old":"false","new":"true"},{"seq":200432,"id":"CVE-2026-48526","ts":1789397250320,"field":"exploit_available","old":"true","new":"false"},{"seq":198356,"id":"CVE-2026-48526","ts":1789391865092,"field":"exploit_available","old":"false","new":"true"},{"seq":196147,"id":"CVE-2026-48526","ts":1789383513465,"field":"exploit_available","old":"true","new":"false"},{"seq":195076,"id":"CVE-2026-48526","ts":1789380394328,"field":"exploit_available","old":"false","new":"true"},{"seq":193863,"id":"CVE-2026-48526","ts":1789378371508,"field":"exploit_available","old":"true","new":"false"},{"seq":192650,"id":"CVE-2026-48526","ts":1789376343185,"field":"exploit_available","old":"false","new":"true"},{"seq":191437,"id":"CVE-2026-48526","ts":1789373271967,"field":"exploit_available","old":"true","new":"false"},{"seq":190222,"id":"CVE-2026-48526","ts":1789369227937,"field":"exploit_available","old":"false","new":"true"},{"seq":189009,"id":"CVE-2026-48526","ts":1789368152153,"field":"exploit_available","old":"true","new":"false"},{"seq":187792,"id":"CVE-2026-48526","ts":1789365080622,"field":"exploit_available","old":"false","new":"true"},{"seq":186579,"id":"CVE-2026-48526","ts":1789363136623,"field":"exploit_available","old":"true","new":"false"},{"seq":185365,"id":"CVE-2026-48526","ts":1789361038889,"field":"exploit_available","old":"false","new":"true"},{"seq":184152,"id":"CVE-2026-48526","ts":1789358039064,"field":"exploit_available","old":"true","new":"false"},{"seq":182403,"id":"CVE-2026-48526","ts":1789354162089,"field":"exploit_available","old":"false","new":"true"},{"seq":181196,"id":"CVE-2026-48526","ts":1789353021359,"field":"exploit_available","old":"true","new":"false"},{"seq":179989,"id":"CVE-2026-48526","ts":1789350100672,"field":"exploit_available","old":"false","new":"true"},{"seq":178782,"id":"CVE-2026-48526","ts":1789347972291,"field":"exploit_available","old":"true","new":"false"},{"seq":177575,"id":"CVE-2026-48526","ts":1789346237135,"field":"exploit_available","old":"false","new":"true"},{"seq":176368,"id":"CVE-2026-48526","ts":1789342888765,"field":"exploit_available","old":"true","new":"false"},{"seq":175822,"id":"CVE-2026-48526","ts":1789338672370,"field":"exploit_available","old":"false","new":"true"},{"seq":175692,"id":"CVE-2026-48526","ts":1789338492446,"field":"exploit_available","old":"true","new":"false"},{"seq":174487,"id":"CVE-2026-48526","ts":1789334680245,"field":"exploit_available","old":"false","new":"true"},{"seq":173282,"id":"CVE-2026-48526","ts":1789333365929,"field":"exploit_available","old":"true","new":"false"},{"seq":172096,"id":"CVE-2026-48526","ts":1789330949638,"field":"exploit_available","old":"false","new":"true"},{"seq":170910,"id":"CVE-2026-48526","ts":1789328489976,"field":"exploit_available","old":"true","new":"false"},{"seq":169705,"id":"CVE-2026-48526","ts":1789326992500,"field":"exploit_available","old":"false","new":"true"},{"seq":168500,"id":"CVE-2026-48526","ts":1789323546332,"field":"exploit_available","old":"true","new":"false"},{"seq":167295,"id":"CVE-2026-48526","ts":1789319436358,"field":"exploit_available","old":"false","new":"true"},{"seq":166090,"id":"CVE-2026-48526","ts":1789318436232,"field":"exploit_available","old":"true","new":"false"},{"seq":164885,"id":"CVE-2026-48526","ts":1789315633568,"field":"exploit_available","old":"false","new":"true"},{"seq":163680,"id":"CVE-2026-48526","ts":1789313362225,"field":"exploit_available","old":"true","new":"false"},{"seq":162475,"id":"CVE-2026-48526","ts":1789311763757,"field":"exploit_available","old":"false","new":"true"},{"seq":161270,"id":"CVE-2026-48526","ts":1789308394020,"field":"exploit_available","old":"true","new":"false"},{"seq":160775,"id":"CVE-2026-48526","ts":1789304327241,"field":"exploit_available","old":"false","new":"true"},{"seq":160322,"id":"CVE-2026-48526","ts":1789303892751,"field":"exploit_available","old":"true","new":"false"},{"seq":159383,"id":"CVE-2026-48526","ts":1789300347809,"field":"exploit_available","old":"false","new":"true"},{"seq":158613,"id":"CVE-2026-48526","ts":1789299388442,"field":"exploit_available","old":"true","new":"false"},{"seq":157577,"id":"CVE-2026-48526","ts":1789296529675,"field":"exploit_available","old":"false","new":"true"},{"seq":156372,"id":"CVE-2026-48526","ts":1789294475218,"field":"exploit_available","old":"true","new":"false"},{"seq":155167,"id":"CVE-2026-48526","ts":1789292736270,"field":"exploit_available","old":"false","new":"true"},{"seq":153962,"id":"CVE-2026-48526","ts":1789289450642,"field":"exploit_available","old":"true","new":"false"},{"seq":152612,"id":"CVE-2026-48526","ts":1789281383223,"field":"exploit_available","old":"false","new":"true"},{"seq":152252,"id":"CVE-2026-48526","ts":1789280988599,"field":"exploit_available","old":"true","new":"false"},{"seq":151213,"id":"CVE-2026-48526","ts":1789277484268,"field":"exploit_available","old":"false","new":"true"},{"seq":150174,"id":"CVE-2026-48526","ts":1789275953960,"field":"exploit_available","old":"true","new":"false"},{"seq":149141,"id":"CVE-2026-48526","ts":1789273649311,"field":"exploit_available","old":"false","new":"true"},{"seq":148108,"id":"CVE-2026-48526","ts":1789270998420,"field":"exploit_available","old":"true","new":"false"},{"seq":146148,"id":"CVE-2026-48526","ts":1789269229514,"field":"exploit_available","old":"false","new":"true"},{"seq":145050,"id":"CVE-2026-48526","ts":1789266203026,"field":"exploit_available","old":"true","new":"false"}]}