Threats tagged 'brew-hermes-agent-cve-2026-48523'

PyJWT versions 2.9.0 through 2.12.1 contain a vulnerability allowing an algorithm allow-list bypass when decoding JWTs with PyJWK or PyJWKClient keys. The library checks the JWT header algorithm against an allowed list but verifies the signature using the algorithm bound to the PyJWK object instead of the header algorithm. This allows an attacker controlling a registered JWK private key to sign tokens with disallowed algorithms while advertising allowed ones, bypassing algorithm restrictions. The issue affects the documented PyJWKClient usage flow and requires control of a registered key. A fix is available in version 2026.7.1.