CVE-2026-101917 · GHSA-2gx3-rcp4-g85q
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
- Risk score
- 67/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values ab…
- Affected
- pyjwt (pip) <= 2.13.0
- Fix
- Upgrade pyjwt to 2.14.0 or later.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pyjwt | pip | <= 2.13.0 | 2.14.0 |
References
- https://github.com/advisories/GHSA-2gx3-rcp4-g85q
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q
- https://nvd.nist.gov/vuln/detail/CVE-2026-101917
- https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1
- https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
- https://github.com/advisories/GHSA-2gx3-rcp4-g85q
Original description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
Last activity 28 Sep 2026. Patch Forecast updates every hour.