CVE-2026-48523
Fixed in a distro release EPSS <1%CVSS 5.4
PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.
Products: jpadilla pyjwt
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyjwt | 2.13.0 |
| PyPI | pyjwt | 2.12.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.2-r25 |
| Chainguard | airflow-core-2 | 2.11.2-r10 |
| Chainguard | airflow-core-3 | 3.2.2-r5 |
| Chainguard | airflow-postgres-fips-3 | 3.2.2-r3 |
| Chainguard | awx | 24.6.1-r41 |
| Chainguard | datadog-agent-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-7.73-core-integrations | 7.73.3-r23 |
| Chainguard | datadog-agent-7.74-core-integrations | 7.74.1-r24 |
| Chainguard | datadog-agent-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-agent-7.76-core-integrations | 7.76.3-r26 |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r16 |
| Chainguard | datadog-agent-7.78-core-integrations | 7.78.4-r10 |
| Chainguard | datadog-agent-7.79-core-integrations | 7.79.2-r6 |
| Chainguard | datadog-agent-7.80-core-integrations | 7.80.4-r3 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.73-core-integrations | 7.73.3-r21 |
| Chainguard | datadog-agent-fips-7.74-core-integrations | 7.74.1-r26 |
| Chainguard | datadog-agent-fips-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.76-core-integrations | 7.76.3-r24 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | 7.77.3-r17 |
| Chainguard | datadog-agent-fips-7.78-core-integrations | 7.78.4-r8 |
| Chainguard | datadog-agent-fips-7.79-core-integrations | 7.79.2-r2 |
| Chainguard | datadog-agent-fips-7.80-core-integrations | 7.80.4-r4 |
| Chainguard | ggshield | 1.52.2-r1 |
| Chainguard | kserve | 0.20.0-r7 |
| Chainguard | kserve-localmodel | 0.20.0-r7 |
| Chainguard | kserve-storage-controller | no fix |
| Chainguard | kserve-storage-controller | 0.19.0-r2 |
| Chainguard | litellm | 1.89.0-r4 |
| Chainguard | metaflow-service-fips | 2.5.0-r5 |
| Chainguard | netbox | 4.6.3-r2 |
| Chainguard | netbox-fips | 4.6.3-r2 |
| Chainguard | openstack-glance-2025.1 | 30.2.0_git20260616-r1 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260511-r5 |
| Chainguard | openstack-glance-2025.2 | 31.1.0_git20260617-r1 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260617-r0 |
| Chainguard | openstack-glance-2026.1 | 32.0.0_git20260617-r1 |
| Chainguard | openstack-glance-2026.1-fips | 32.0.0_git20260617-r1 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r1 |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r0 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260617-r2 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260617-r1 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260624-r1 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20260611-r3 |
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260618-r4 |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260618-r2 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260618-r3 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260616-r1 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260616-r4 |
| Chainguard | openstack-keystone-2026.1-fips | 29.0.1_git20260603-r6 |
| Chainguard | openstack-placement-2025.1 | 13.0.0_git20260617-r2 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260617-r1 |
| Chainguard | openstack-placement-2025.2 | 14.0.0_git20260617-r2 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260309-r1 |
| Chainguard | openstack-placement-2026.1 | 15.0.0_git20260617-r2 |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260311-r1 |
| Chainguard | superset-5.0 | 5.0.0-r26 |
| Chainguard | superset-6.0 | 6.0.0-r17 |
| Chainguard | superset-6.1 | 6.1.0-r2 |
| Chainguard | superset-fips-6.1 | 6.1.0-r1 |
| Chainguard | wazuh-manager-framework | 4.14.5-r5 |
| Chainguard | wazuh-manager-framework-fips | 4.14.5-r5 |
| Debian 13 | pyjwt | no fix |
| Debian 14 | pyjwt | 2.13.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Micro 5.5 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 16.0 | python-PyJWT | 2.12.1-160000.2.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-PyJWT | 2.12.1-160000.2.1 |
| SUSE Linux Micro 6.0 | python-PyJWT | 2.9.0-3.1 |
| SUSE Linux Micro 6.1 | python-PyJWT | 2.12.1-slfo.1.1_2.1 |
| SUSE Linux Micro 6.2 | python-PyJWT | 2.12.1-160000.2.1 |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.4 |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.2 |
| Ubuntu 25.10 | pyjwt | no fix |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.1 |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm2 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm2 |
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm2 |
| Wolfi | datadog-agent-7.72-core-integrations | no fix |
| Wolfi | datadog-agent-7.73-core-integrations | 7.73.3-r23 |
| Wolfi | datadog-agent-7.74-core-integrations | 7.74.1-r24 |
| Wolfi | datadog-agent-7.75-core-integrations | no fix |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-agent-7.76-core-integrations | 7.76.3-r26 |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r16 |
| Wolfi | datadog-agent-7.78-core-integrations | 7.78.4-r10 |
| Wolfi | datadog-agent-7.79-core-integrations | 7.79.2-r6 |
| Wolfi | datadog-agent-7.80-core-integrations | 7.80.4-r3 |
| Wolfi | ggshield | 1.52.2-r1 |
| Wolfi | kserve | 0.20.0-r7 |
| Wolfi | kserve-localmodel | 0.20.0-r7 |
| Wolfi | kserve-storage-controller | no fix |
| Wolfi | kserve-storage-controller | 0.19.0-r2 |
| Wolfi | superset-6.0 | 6.0.0-r17 |
| Wolfi | superset-6.1 | 6.1.0-r2 |
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.2.1 |
| openSUSE Tumbleweed | python-PyJWT | 2.13.0-1.1 |