https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T23:27:58.860921+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-102267 CVE-2026-102267 — PyJWT: PyJWKClient follows redirects when fetching JWKS 2026-09-30T23:27:58.865129+00:00

Affected: jpadilla pyjwt

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

 https://vulnerability.circl.lu/vuln/ghsa-9v7f-9g4p-ffgj GHSA-9v7f-9g4p-ffgj — PyJWT: PyJWKClient follows redirects when fetching JWKS 2026-09-30T23:27:58.865232+00:00

Affected: PyPI: PyJWT

### Summary

PyJWT 2.13.0 `PyJWKClient` followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host.

### Impact

When an application uses `PyJWKClient` with caller-supplied request headers and an attacker can influence the configured endpoint's response, the redirected request could expose those headers and the redirected response could be used as authoritative key material. This could cause JWKS trust poisoning and, in affected mixed-configuration applications, forged JWT acceptance. The issue requires an attacker-influenced redirect from the configured JWKS endpoint; it is not triggered by a token `kid` alone.

### Affected versions

PyJWT `<= 2.13.0`.

### Fix

The issue is fixed on `master` in commit [`0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56`](https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56). `PyJWKClient` now disables automatic redirects for JWKS fetches. Regression tests verify that a redirect is rejected without contacting its destination, while normal fetches, headers, caching, errors, timeouts, and SSL context remain covered.

The fix is present in the unreleased development branch. The patched version will be recorded after a released PyJWT 2.x version containing the fix is confirmed.

### Credit

Credit: the original reporter of GHSA-9v7f-9g4p-ffgj. Additional redirect header-leak and cache-poisoning evidence fro…