CVE-2026-48524: PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
> [!NOTE] > The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.
Summary PyJWKClient.getsigningkey() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.
Additionally, fetchdata() finally block clears the JWKS cache on network error.
Root Cause jwt/jwksclient.py:172-198 - getsigningkey(kid) calls getsigningkeys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwksclient.py:120-122 - finally block writes None to cache on error, clearing valid data.
Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth)
Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block
Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)
Other sources
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.getsigningkey() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pyjwtto a version that resolves this vulnerability.Fixed in 2.13.0 - Upgrade
Upgrade
PyJWKClientto a version that resolves this vulnerability.Fixed in 2.13.0 - Configuration
Implement a refresh cooldown in PyJWKClient so that refresh is refused more than once per TTL period when handling unknown kid values.
jwt/jwks_client.py (PyJWKClient.get_signing_key / cache refresh logic) refresh cooldown (refuse refresh more than once per TTL period) = enabled - Configuration
Move the JWKS cache write from the finally block to the else block so that on network error the valid cached JWKS data is not cleared (avoid the finally block writing None to cache on error).
jwt/jwks_client.py (PyJWKClient JWKS cache) cache write location on network error = write on success only (move from finally to else) - Compensating control
Add an application-level rate limit for outbound requests to the JWKS endpoint and/or block/protect the JWKS endpoint against attacker-controlled unknown-kid traffic, since PyJWKClient behavior was previously unbounded for unknown kids.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48524?
The severity of CVE-2026-48524 is rated as low with a score of 3.7.
How do I fix CVE-2026-48524?
To fix CVE-2026-48524, update PyJWT to version 2.13.0 or later.
What risk does CVE-2026-48524 pose to applications?
CVE-2026-48524 poses a risk of denial-of-service due to unbounded requests to the JWKS endpoint caused by attacker-controlled kid values.
Which software is affected by CVE-2026-48524?
CVE-2026-48524 affects the PyJWT library, specifically versions prior to 2.13.0.
What is the nature of the vulnerability described in CVE-2026-48524?
CVE-2026-48524 is a vulnerability in PyJWKClient that allows unlimited JWKS endpoint requests, potentially leading to service disruption.