CVE-2026-48524: PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

Published May 28, 2026
·
Updated

> [!NOTE] > The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.

Summary PyJWKClient.getsigningkey() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.

Additionally, fetchdata() finally block clears the JWKS cache on network error.

Root Cause jwt/jwksclient.py:172-198 - getsigningkey(kid) calls getsigningkeys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwksclient.py:120-122 - finally block writes None to cache on error, clearing valid data.

Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth)

Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block

Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)

Other sources

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.getsigningkey() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.

MITRE

Affected Software

6 affected componentsFixes available
pypi/pyjwt<2.13.0
pip/pyjwt<=2.12.1
2.13.0
Pyjwt Project Pyjwt<2.13.0
IBM Engineering AI Hub<=1.0.0
IBM Engineering AI Hub<=1.1.0
IBM Engineering AI Hub<=1.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/pyjwt to a version that resolves this vulnerability.

    Fixed in 2.13.0
  2. Upgrade

    Upgrade PyJWKClient to a version that resolves this vulnerability.

    Fixed in 2.13.0
  3. Configuration

    Implement a refresh cooldown in PyJWKClient so that refresh is refused more than once per TTL period when handling unknown kid values.

    jwt/jwks_client.py (PyJWKClient.get_signing_key / cache refresh logic) refresh cooldown (refuse refresh more than once per TTL period) = enabled
  4. Configuration

    Move the JWKS cache write from the finally block to the else block so that on network error the valid cached JWKS data is not cleared (avoid the finally block writing None to cache on error).

    jwt/jwks_client.py (PyJWKClient JWKS cache) cache write location on network error = write on success only (move from finally to else)
  5. Compensating control

    Add an application-level rate limit for outbound requests to the JWKS endpoint and/or block/protect the JWKS endpoint against attacker-controlled unknown-kid traffic, since PyJWKClient behavior was previously unbounded for unknown kids.

Event History

May 28, 2026
CVE Published
via MITRE·03:07 PM
Data Sourced
via MITRE·03:07 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 15, 2026
Advisory Published
via GitHub·05:28 PM
Data Sourced
via GitHub·05:28 PM
DescriptionSeverityWeaknessAffected Software
Jul 14, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-48524?

The severity of CVE-2026-48524 is rated as low with a score of 3.7.

2

How do I fix CVE-2026-48524?

To fix CVE-2026-48524, update PyJWT to version 2.13.0 or later.

3

What risk does CVE-2026-48524 pose to applications?

CVE-2026-48524 poses a risk of denial-of-service due to unbounded requests to the JWKS endpoint caused by attacker-controlled kid values.

4

Which software is affected by CVE-2026-48524?

CVE-2026-48524 affects the PyJWT library, specifically versions prior to 2.13.0.

5

What is the nature of the vulnerability described in CVE-2026-48524?

CVE-2026-48524 is a vulnerability in PyJWKClient that allows unlimited JWKS endpoint requests, potentially leading to service disruption.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203