tocsin

PyPI/pyjwt CVE-2026-48526: high 7.4, EPSS 0.43%

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate

Action: Upgrade pyjwt to 2.13.0 or later.

pip install pyjwt==2.13.0

Affected

introducedfixedlast affected
02.13.0-

Fixed versions

2.13.0

Sources

CVE-2026-48526 · published · modified · JSON