CVE-2026-48523 jpadilla CVE debrief

Who should care

Defenders responsible for systems utilizing PyJWT, particularly those using the PyJWKClient.get_signing_key_from_jwt(...) flow, should assess exposure and prioritize mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review affected systems and plan for upgrades or mitigations.

Why it matters

CVE-2026-48523 is a medium-severity vulnerability in PyJWT that allows an attacker to bypass the verifier-side algorithm allow-list, potentially leading to signature verification bypass. Defenders should prioritize upgrading PyJWT to version 2.13.0 or later and review systems using affected versions for potential exposure.

• Potential signature verification bypass
• Possible exploitation by attackers controlling registered JWK/JWKS private keys
• Need for verification of affected systems and upgrade to fixed version

Technical summary

The vulnerability in PyJWT allows an attacker to bypass the verifier-side algorithm allow-list when using a PyJWK key. This is achieved by signing with a disallowed algorithm and advertising an allowed algorithm in the JWT header. The issue affects PyJWT versions from 2.9.0 to 2.12.1 and is fixed in version 2.13.0. The vulnerability impacts the documented PyJWKClient.get_signing_key_from_jwt(...) flow. Defenders should prioritize upgrading PyJWT to version 2.13.0 or later to mitigate this vulnerability. Systems using affected versions of PyJWT should be reviewed for potential exposure.

Defensive priority

Defenders should prioritize upgrading PyJWT to version 2.13.0 or later to mitigate this vulnerability. Systems using affected versions of PyJWT should be reviewed for potential exposure, particularly those utilizing the PyJWKClient.get_signing_key_from_jwt(...) flow.

Recommended defensive actions

• Upgrade PyJWT to version 2.13.0 or later
• Review systems using affected versions of PyJWT for potential exposure
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and the NVD vulnerability detail page. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow in PyJWT versions from 2.9.0 to 2.12.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.