CVE-2026-102267 in PyJWT
Summary
by MITRE • 09/29/2026
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in PyJWT prior to version 2.14.0 represents a critical security flaw within the PyJWKClient component, which is responsible for fetching and caching JSON Web Key Set (JWKS) data from remote endpoints. This issue stems from an improper handling of HTTP redirect responses during the key retrieval process. When the client interacts with a configured trusted JWKS endpoint, it fails to revalidate whether the final destination of any redirects remains within the established trust boundary. In standard web security practices, following redirects without verifying that the ultimate target is still authorized can lead to significant data exposure or integrity violations. By not enforcing this validation, the library inadvertently allows an attacker who controls a redirect chain originating from a trusted JWKS endpoint to manipulate where the key material is fetched from.
The technical mechanism of exploitation relies on the ability of an adversary to influence the HTTP response headers returned by a compromised or maliciously configured server that acts as part of the trust chain. If such a server issues a 3xx redirect status code pointing to a domain under attacker control, PyJWKClient will follow this instruction and retrieve the JSON Web Key Set from the new location. Because the client does not check if the redirected URL matches the original trusted host or pattern, it treats the keys obtained from the unauthorized source as legitimate verification keys for JWTs issued by the intended identity provider. This behavior effectively bypasses the security assumptions built into the JWKS protocol, which relies on the integrity and authenticity of the key distribution channel to ensure that tokens are verified against the correct public keys.
The operational impact of this vulnerability is severe, primarily centering on authentication bypass and credential disclosure. An attacker who successfully exploits this flaw can substitute the legitimate verification keys with their own maliciously generated keys. Consequently, they can forge valid JSON Web Tokens using a private key corresponding to the forged public key published in the redirected JWKS endpoint. This allows the attacker to impersonate any user or service that relies on PyJWT for authentication and authorization checks within the affected application. Furthermore, if the redirect leads to an endpoint controlled by the attacker that also captures request headers or cookies during the fetch operation, sensitive session data or other credentials might be exfiltrated, leading to a comprehensive compromise of the system's security posture.
This vulnerability aligns with CWE-295 Improper Certificate Validation and CWE-807 Reliance on Untrusted Inputs in Security Decisions, as it involves failing to properly validate the source of cryptographic material against expected trust boundaries. In terms of MITRE ATT&CK mapping, this behavior facilitates Initial Access through Authentication Bypass using Forged Tokens (T1528) and potentially Credential Access if sensitive data is intercepted during the redirect process. The flaw highlights a common pitfall in implementing OAuth 2.0 and OpenID Connect flows where automatic redirection without strict domain validation can undermine the entire identity verification mechanism.
To mitigate this risk, organizations must immediately upgrade PyJWT to version 2.14.0 or later, which includes patches that enforce strict revalidation of redirect destinations against the configured JWKS trust boundary. Until an update is applied, developers should consider implementing custom logic in their application layer to intercept and validate HTTP responses before passing them to the library, ensuring that no redirects lead outside the expected domain. Additionally, monitoring logs for unusual patterns in key retrieval requests or unexpected changes in JWT verification failures can help detect potential exploitation attempts. It is also recommended to review all JWKS endpoint configurations to ensure they are hosted on secure, trusted domains with proper TLS enforcement and access controls to prevent unauthorized modification of redirect targets.