CVE-2026-102267
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected…
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
- Vendor
- pyjwt project
- Product
- pyjwt
- CVSS 3.1
- 9.1 (critical), scored by NVD (primary)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 3.1
- 7.4 (high), scored by security-advisories@github.comCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Published
- 2026-09-28
- NVD modified
- 2026-10-07
- NVD status
- Analyzed
Not in the CISA KEV catalogue at the last update.
EPSS
0.16% chance of exploitation in the next 30 days (percentile 4th)
FIRST EPSS, updated 17 Oct 2026. About EPSS
CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.
References
- github.com (Patch)
- github.com (Product, Release Notes)
- github.com (Patch, Vendor Advisory)
Data last updated 18 Oct 2026. Sources: NVD API 2.0, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.