{"id":"CVE-2026-102267","title":"PyJWT is a Python implementation of JSON Web Token standards","summary":"PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS en…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-200","CWE-345","CWE-918","CWE-346"],"vendor":"pyjwt_project","product":"pyjwt","affected":["pyjwt < 2.14.0"],"patched":["pyjwt 2.14.0"],"published":"2026-09-28","updated":"2026-10-07","sourceUpdated":"2026-10-07T20:27:45.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102267","references":[{"url":"https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56","label":"security-advisories@github.com"},{"url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","label":"security-advisories@github.com"},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102267.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-102267"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542690"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102267"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102267"},{"url":"https://github.com/advisories/GHSA-9v7f-9g4p-ffgj"},{"url":"https://github.com/jpadilla/pyjwt"},{"url":"https://pypi.org/project/pyjwt"},{"url":"https://access.redhat.com/errata/RHSA-2026:82415"},{"url":"https://access.redhat.com/errata/RHSA-2026:82368"},{"url":"https://access.redhat.com/errata/RHSA-2026:82061"},{"url":"https://access.redhat.com/errata/RHSA-2026:82059"},{"url":"https://access.redhat.com/errata/RHSA-2026:82371"},{"url":"https://access.redhat.com/errata/RHSA-2026:87004"},{"url":"https://access.redhat.com/errata/RHSA-2026:87120"},{"url":"https://access.redhat.com/errata/RHSA-2026:87124"},{"url":"https://access.redhat.com/errata/RHSA-2026:84785"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","pip","osv"],"epss":0.00159,"epssPercentile":0.0498,"aliases":["GHSA-9v7f-9g4p-ffgj","PYSEC-2026-4144"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-01T14:56:20.518342Z"},"ingestedAt":"2026-09-28T21:20:54.780Z","slug":"CVE-2026-102267","body":"## Overview\n\nPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.\n\n## Affected\n\n- `pyjwt < 2.14.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pyjwt 2.14.0`\n\n## Package advisory (CVE-2026-102267)\n\nAffected packages:\n\n- `PyJWT <= 2.13.0`\n\nPatched in:\n\n- `PyJWT 2.14.0`\n\nSource: https://github.com/advisories/GHSA-9v7f-9g4p-ffgj\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, … · no fix planned: OpenShift Lightspeed, Red Hat Ceph Storage 4, Red Hat Ceph Storage 7, Red Hat Ceph Storage 9, … · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102267.json)\n- **RHSA-2026:82415** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82415)\n- **RHSA-2026:82368** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82368)\n- **RHSA-2026:82061** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82061)\n- **RHSA-2026:82059** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82059)\n- **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371)\n- **RHSA-2026:87004** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87004)\n- **RHSA-2026:87120** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87120)\n- **RHSA-2026:87124** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87124)\n- **RHSA-2026:84785** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84785)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}