VulnerabilityAnalyzed

CVE-2026-102267

This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect.

CRITICAL 9.1EPSS 0.16%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.16% probability · 5th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-200, CWE-345, CWE-918
Affected: pyjwt project/pyjwt
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.2% on 29 September 2026 to 0.2% on 26 October 2026.

References

https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56Patch
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0Product, Release Notes
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgjPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.