CVE-2026-48523

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48523
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48523.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48523
Aliases
Downstream
BELL (1)
CGA (127)
CLEANSTART (21)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (27)
openSUSE (2)
ROOT (1)
SUSE (6)
UBUNTU (1)
Related
openSUSE (2)
SUSE (6)
Published
2026-05-28T15:10:19Z
Modified
2026-09-18T03:46:50Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
Details

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-347"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48523.json"
}
References

Affected packages

Git / github.com/jpadilla/pyjwt

Affected ranges

Type
GIT
Repo
https://github.com/jpadilla/pyjwt
Events
Introduced
868cf4ab2ca5a0a39da40e5a14dd740b203662b2
Fixed
7144e4534c34810f4525dc4578a32addd8212cff
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.9.0"
        },
        {
            "fixed":  "2.13.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

2.*
2.10.0
2.10.1
2.11.0
2.12.0
2.12.1
2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48523.json"