CVE-2026-48526 is a security flaw in the PyJWT library where the decoding process fails to properly validate the use of JSON Web Keys (JWK) in the HMAC algorithm when asymmetric algorithms are also supported. This misconfiguration allows a remote attacker to forge JWTs by using the issuer's public key as the HMAC secret key, resulting in authentication bypass and unauthorized access. Red Hat products are affected only if they utilize this specific verifier configuration. The vulnerability is tracked under CWE-347 (Improper Verification of Cryptographic Signature) and related CWEs. Red Hat has published advisories and updates to address this issue.

The vulnerability allows an attacker to bypass authentication mechanisms relying on PyJWT by forging JWTs, potentially gaining unauthorized access to sensitive data and elevated privileges. This can compromise confidentiality and integrity of affected systems. The impact is rated as high by Red Hat, with a CVSS v3 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). No known exploits are reported in the wild at this time.

Red Hat has released security updates that fix this vulnerability. Users should apply the official patches provided by Red Hat for affected products. The vulnerability only affects configurations where PyJWT is misconfigured to accept both symmetric and asymmetric algorithms simultaneously; ensuring proper JWT verifier configuration can also mitigate the risk. Check Red Hat advisories and update to fixed versions as soon as possible. Patch status is confirmed with official fixes available.