---
id: CVE-2026-102267
title: PyJWT is a Python implementation of JSON Web Token standards
summary: >-
  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0,
  PyJWT PyJWKClient is affected because redirect destinations are not
  revalidated against the JWKS trust boundary. This occurs when a configured
  trusted JWKS en…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-200
  - CWE-345
  - CWE-918
  - CWE-346
vendor: pyjwt_project
product: pyjwt
affected:
  - pyjwt < 2.14.0
patched:
  - pyjwt 2.14.0
published: '2026-09-28'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T20:27:45.713'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102267'
references:
  - url: >-
      https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
    label: security-advisories@github.com
  - url: 'https://github.com/jpadilla/pyjwt/releases/tag/2.14.0'
    label: security-advisories@github.com
  - url: 'https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102267.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-102267'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2542690'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102267'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102267'
  - url: 'https://github.com/advisories/GHSA-9v7f-9g4p-ffgj'
  - url: 'https://github.com/jpadilla/pyjwt'
  - url: 'https://pypi.org/project/pyjwt'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82415'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82368'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82061'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82059'
  - url: 'https://access.redhat.com/errata/RHSA-2026:82371'
  - url: 'https://access.redhat.com/errata/RHSA-2026:87004'
  - url: 'https://access.redhat.com/errata/RHSA-2026:87120'
  - url: 'https://access.redhat.com/errata/RHSA-2026:87124'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84785'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - pip
  - osv
epss: 0.00159
epssPercentile: 0.0498
aliases:
  - GHSA-9v7f-9g4p-ffgj
  - PYSEC-2026-4144
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T14:56:20.518342Z'
ingestedAt: '2026-09-28T21:20:54.780Z'
---

## Overview

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

## Affected

- `pyjwt < 2.14.0`

## Remediation

Upgrade past the affected range:

- `pyjwt 2.14.0`

## Package advisory (CVE-2026-102267)

Affected packages:

- `PyJWT <= 2.13.0`

Patched in:

- `PyJWT 2.14.0`

Source: https://github.com/advisories/GHSA-9v7f-9g4p-ffgj

## Vendor advisories

- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server, … · no fix planned: OpenShift Lightspeed, Red Hat Ceph Storage 4, Red Hat Ceph Storage 7, Red Hat Ceph Storage 9, … · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102267.json)
- **RHSA-2026:82415** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82415)
- **RHSA-2026:82368** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82368)
- **RHSA-2026:82061** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82061)
- **RHSA-2026:82059** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82059)
- **RHSA-2026:82371** · Red Hat · fixed in: Red Hat AI Inference Server 3.5 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82371)
- **RHSA-2026:87004** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87004)
- **RHSA-2026:87120** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87120)
- **RHSA-2026:87124** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87124)
- **RHSA-2026:84785** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84785)