PyPI/pyjwt CVE-2026-48524: low 3.7, EPSS 0.40%

PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

Action: Upgrade pyjwt to 2.13.0 or later.

pip install pyjwt==2.13.0

Affected

Fixed versions

Sources

• osv: GHSA-fhv5-28vv-h8m8
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48524
• https://github.com/github/advisory-database/pull/8522
• https://github.com/jpadilla/pyjwt
• https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-177.yaml

CVE-2026-48524 · published 2026-06-15T17:28:46Z · modified 2026-09-10T03:50:49.375741307Z · JSON