PYSEC-2026-4144: PyJWT: PyJWKClient follows redirects when fetching JWKS

Q: Which deployments are exposed to this issue?

Deployments using PyJWT PyJWKClient before version 2.14.0 are affected if they fetch keys from a configured trusted JWKS endpoint that can return an attacker-influenced redirect.

Q: What does an attacker need to exploit it?

An attacker needs to cause the configured JWKS endpoint to return a redirect whose destination they influence. PyJWKClient then follows that redirect without revalidating it against the JWKS trust boundary.

Q: What is the impact of a successful exploit?

The redirected response can be consumed as key material, allowing verification keys to be substituted. Credentials forwarded during the request may also be disclosed.

Q: How can this be remediated?

Upgrade PyJWT to version 2.14.0, which fixes the redirect handling issue.

Published Sep 28, 2026

Updated

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

Affected Software

1 affected component

pypi/pyjwt<2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Sep 28, 2026

CVE Published

via OSV·08:23 PM

Data Sourced

via OSV·08:23 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using PyJWT PyJWKClient before version 2.14.0 are affected if they fetch keys from a configured trusted JWKS endpoint that can return an attacker-influenced redirect.

What does an attacker need to exploit it?

An attacker needs to cause the configured JWKS endpoint to return a redirect whose destination they influence. PyJWKClient then follows that redirect without revalidating it against the JWKS trust boundary.

What is the impact of a successful exploit?

The redirected response can be consumed as key material, allowing verification keys to be substituted. Credentials forwarded during the request may also be disclosed.

How can this be remediated?

Upgrade PyJWT to version 2.14.0, which fixes the redirect handling issue.

PYSEC-2026-4144: PyJWT: PyJWKClient follows redirects when fetching JWKS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful exploit?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful exploit?

How can this be remediated?