Threats tagged 'brew-hermes-agent-cve-2026-102267'

PyJWT versions up to 2.13.0 contain a vulnerability in the PyJWKClient component, which follows HTTP redirects when fetching JSON Web Key Sets (JWKS) without validating the redirect destination. This allows a trusted JWKS endpoint to redirect requests to an attacker-controlled host, potentially exposing sensitive request headers and enabling JWKS trust poisoning. The vulnerability is fixed in PyJWT 2.14.0.