Description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Metrics
CVSS 3.1 7.4/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| jpadilla | pyjwt | < 2.13.0 |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
References
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wxExploit, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:25902
- https://access.redhat.com/errata/RHSA-2026:25928
- https://access.redhat.com/errata/RHSA-2026:26206
- https://access.redhat.com/errata/RHSA-2026:28571
- https://access.redhat.com/errata/RHSA-2026:30076
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:33683
- https://access.redhat.com/errata/RHSA-2026:34160
- https://access.redhat.com/errata/RHSA-2026:34365
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:35835
- https://access.redhat.com/errata/RHSA-2026:35836
- https://access.redhat.com/errata/RHSA-2026:35837
- https://access.redhat.com/errata/RHSA-2026:35845
- https://access.redhat.com/errata/RHSA-2026:36350
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:40967
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42132
- https://access.redhat.com/errata/RHSA-2026:42142
- https://access.redhat.com/errata/RHSA-2026:42144
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/errata/RHSA-2026:48085
- https://access.redhat.com/errata/RHSA-2026:50222
- https://access.redhat.com/errata/RHSA-2026:50223
- https://access.redhat.com/errata/RHSA-2026:50263
- https://access.redhat.com/errata/RHSA-2026:50319
- https://access.redhat.com/errata/RHSA-2026:50336
- https://access.redhat.com/errata/RHSA-2026:50340
- https://access.redhat.com/errata/RHSA-2026:50904
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/security/cve/CVE-2026-48526
- https://bugzilla.redhat.com/show_bug.cgi?id=2482734
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json
Timeline
- Published
- May 28, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Modified