CVE-2026-48526

HIGH 7.4

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

CVSS Score

7.4

EPSS Score

0.4%

EPSS Percentile

32th

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

CWE	CWE-287 CWE-347
Vendor	jpadilla
Product	pyjwt
Published	May 28, 2026
Last Updated	Jul 23, 2026

Stay Ahead of the Next One

Get instant alerts for jpadilla pyjwt

Be the first to know when new high vulnerabilities affecting jpadilla pyjwt are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

jpadilla / pyjwt

< 2.13.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-48526 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2482734 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34160 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34365 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35845 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25902 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35837 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35836 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35835 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26206 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30089 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30088 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42144 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42132 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34374 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42142 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43038 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42644 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37275 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30076 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41066 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33683 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28571 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36350 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40967