{"id":"CVE-2026-102267","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102267","generatedAt":"2026-10-27T23:59:28.484Z","title":"This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect.","description":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.","published":"2026-09-28T21:17:14.000Z","lastModified":"2026-10-07T20:27:46.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-200","CWE-345","CWE-918"],"affected":["pyjwt project/pyjwt"],"epss":{"score":0.00159,"percentile":0.0499,"date":"2026-10-26","history":[{"date":"2026-09-29","score":0.00157,"percentile":0.04146}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-07T22:30:11.000Z","detail":{"from":"7.4","score":"9.1","severity":"CRITICAL","fromSeverity":"HIGH"},"summary":"Now scored CVSS 9.1 CRITICAL (was 7.4)."},{"kind":"new","label":"New CVE","at":"2026-09-28T21:17:14.000Z","detail":{"score":"7.4","severity":"HIGH","publishedAt":"2026-09-28T21:17:14.430Z"},"summary":"New CVE, critical severity (CVSS 9.1)."}],"references":[{"url":"https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","tags":["Product","Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj","tags":["Patch","Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102267","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}