CVE-2026-102267: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in jpadilla pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
AI Analysis
Technical Summary
PyJWT is a Python library implementing JSON Web Token standards. In versions before 2.14.0, the PyJWKClient component does not revalidate redirect destinations against the JWKS trust boundary. If a trusted JWKS endpoint returns a redirect influenced by an attacker, PyJWKClient follows the redirect and uses the redirected response as key material. This can disclose forwarded credentials or allow an attacker to substitute verification keys, compromising token verification integrity. The vulnerability is addressed in PyJWT version 2.14.0.
Potential Impact
An attacker controlling or influencing a JWKS endpoint can cause PyJWKClient to accept malicious key material by following attacker-controlled redirects. This can lead to unauthorized disclosure of credentials or acceptance of forged tokens due to substituted verification keys. The vulnerability impacts confidentiality and integrity of authentication processes relying on PyJWT.
Mitigation Recommendations
Upgrade PyJWT to version 2.14.0 or later, where this issue is fixed. No other mitigations are specified or required.
CVE-2026-102267: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in jpadilla pyjwt
Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
CVSS v3.1
Score 7.4high
Affected software
jpadilla
pyjwt
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PyJWT is a Python library implementing JSON Web Token standards. In versions before 2.14.0, the PyJWKClient component does not revalidate redirect destinations against the JWKS trust boundary. If a trusted JWKS endpoint returns a redirect influenced by an attacker, PyJWKClient follows the redirect and uses the redirected response as key material. This can disclose forwarded credentials or allow an attacker to substitute verification keys, compromising token verification integrity. The vulnerability is addressed in PyJWT version 2.14.0.
Potential Impact
An attacker controlling or influencing a JWKS endpoint can cause PyJWKClient to accept malicious key material by following attacker-controlled redirects. This can lead to unauthorized disclosure of credentials or acceptance of forged tokens due to substituted verification keys. The vulnerability impacts confidentiality and integrity of authentication processes relying on PyJWT.
Mitigation Recommendations
Upgrade PyJWT to version 2.14.0 or later, where this issue is fixed. No other mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-28T20:11:16.658Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abad292f7a7c541062fe5b9
Added to database: 09/28/2026, 20:48:18 UTC
Last enriched: 09/28/2026, 21:02:47 UTC
Last updated: 09/29/2026, 02:48:24 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.