REDHAT-BUG-2542690: High severity pypi/pyjwt vulnerability

Q: Which deployments are exposed?

Deployments using PyJWT's PyJWKClient with a configured trusted JWKS endpoint are affected if they use a version earlier than 2.14.0 and that endpoint can return an attacker-influenced redirect.

Q: What does an attacker need to exploit this issue?

The attacker needs to influence a redirect returned by the configured trusted JWKS endpoint. PyJWKClient then follows that redirect without revalidating the destination against the JWKS trust boundary.

Q: What is the potential impact of a successful exploit?

Forwarded credentials may be disclosed to the redirected destination, or verification keys may be substituted because the redirected response is consumed as key material.

Q: How can this be remediated?

Update PyJWT to version 2.14.0 or later, which includes the fix.

Q: How can I determine whether my application is affected?

Check whether the application uses PyJWKClient and runs a PyJWT version earlier than 2.14.0. Then review whether its configured JWKS endpoint can produce attacker-influenced redirects.

Published Sep 28, 2026

Updated

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

Affected Software

1 affected component

pypi/pyjwt<2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Sep 28, 2026

Data Sourced

via Red Hat·08:47 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using PyJWT's PyJWKClient with a configured trusted JWKS endpoint are affected if they use a version earlier than 2.14.0 and that endpoint can return an attacker-influenced redirect.

What does an attacker need to exploit this issue?

The attacker needs to influence a redirect returned by the configured trusted JWKS endpoint. PyJWKClient then follows that redirect without revalidating the destination against the JWKS trust boundary.

What is the potential impact of a successful exploit?

Forwarded credentials may be disclosed to the redirected destination, or verification keys may be substituted because the redirected response is consumed as key material.

How can this be remediated?

Update PyJWT to version 2.14.0 or later, which includes the fix.

How can I determine whether my application is affected?

Check whether the application uses PyJWKClient and runs a PyJWT version earlier than 2.14.0. Then review whether its configured JWKS endpoint can produce attacker-influenced redirects.

REDHAT-BUG-2542690: High severity pypi/pyjwt vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the potential impact of a successful exploit?

How can this be remediated?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the potential impact of a successful exploit?

How can this be remediated?

How can I determine whether my application is affected?