The vulnerability in pyjwt's PyJWKClient.get_signing_key() method forces an HTTP request to the JWKS endpoint for every JWT token with an unknown kid header value, bypassing any caching and without rate limiting. Since the kid value is unverified, an attacker can trigger unlimited outbound requests. Additionally, on network errors, the JWKS cache is cleared due to a finally block writing None to the cache, which can cause cascading failures by breaking legitimate authentication. The root cause is the lack of a refresh cooldown and improper cache clearing logic. This affects all pyjwt versions with PyJWKClient from 2.4.0 up to but not including 2.13.0.

The vulnerability can be exploited to cause denial of service against the JWKS endpoint by triggering unlimited requests with invalid kid values. It can also degrade application availability due to network I/O latency and cause cascading failures by clearing the JWKS cache on network errors, which breaks legitimate authentication until the next successful fetch. The impact is limited to reduced authentication availability rather than complete denial of service.

A patch is available that addresses this issue by adding a refresh cooldown to prevent frequent JWKS refreshes within the TTL period and by moving the cache write operation from a finally block to an else block to avoid clearing valid cache data on errors. Users should upgrade to pyjwt version 2.13.0 or later to remediate this vulnerability.