CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyJWTto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PyJWT versions before 2.14.0 and calling PyJWKClient.get_signing_key_from_jwt with a configured JWKS endpoint are exposed. The condition is triggered when tokens contain a kid that is absent from the cached JWKS.
What does an attacker need to do to trigger the behavior?
An attacker only needs to send unauthenticated tokens with an unknown kid value. Repeated use of one unknown kid or use of varying unknown kid values can cause a JWKS refresh for each cache miss.
What is the practical impact?
Attacker traffic can amplify outbound requests from the application to its configured JWKS endpoint. The reported impact is availability degradation rather than loss of confidentiality or integrity.
What should be done if upgrading is not immediately possible?
The provided data identifies 2.14.0 as the fix but does not specify a workaround. Until upgrading, treat endpoints that process untrusted JWTs through PyJWKClient as susceptible to outbound JWKS request amplification.