PYSEC-2026-4140: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Q: Which deployments are exposed to this behavior?

Deployments using PyJWT PyJWKClient and get_signing_key_from_jwt with a configured JWKS endpoint are exposed if they run a version prior to 2.14.0. The issue is triggered when tokens contain a kid value that is absent from the cached JWKS.

Q: What does an attacker need to do to trigger the request amplification?

An attacker only needs to send unauthenticated tokens with an unknown kid. Repeated use of the same unknown kid or use of varying unknown kid values can cause a JWKS refresh for each cache miss.

Q: What is the impact of successful exploitation?

Each unknown-kid cache miss can cause PyJWKClient to make an outbound request to the configured JWKS endpoint. This can amplify attacker traffic against that endpoint and affect availability.

Q: How can this be remediated?

Upgrade PyJWT to version 2.14.0, which fixes the issue.

Published Sep 28, 2026

Updated

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.

Affected Software

1 affected component

pypi/pyjwt<2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Sep 28, 2026

CVE Published

via OSV·08:07 PM

Data Sourced

via OSV·08:07 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this behavior?

Deployments using PyJWT PyJWKClient and get_signing_key_from_jwt with a configured JWKS endpoint are exposed if they run a version prior to 2.14.0. The issue is triggered when tokens contain a kid value that is absent from the cached JWKS.

What does an attacker need to do to trigger the request amplification?

An attacker only needs to send unauthenticated tokens with an unknown kid. Repeated use of the same unknown kid or use of varying unknown kid values can cause a JWKS refresh for each cache miss.

What is the impact of successful exploitation?

Each unknown-kid cache miss can cause PyJWKClient to make an outbound request to the configured JWKS endpoint. This can amplify attacker traffic against that endpoint and affect availability.

How can this be remediated?

Upgrade PyJWT to version 2.14.0, which fixes the issue.

PYSEC-2026-4140: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this behavior?

What does an attacker need to do to trigger the request amplification?

What is the impact of successful exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this behavior?

What does an attacker need to do to trigger the request amplification?

What is the impact of successful exploitation?

How can this be remediated?