CVE catalog

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occ

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpyjwtsid2.15.1-1fixed
Debianpyjwtforky2.15.1-1fixed
Debianpyjwttrixie2.10.1-2+deb13u1vulnerable
Debianpyjwttrixie-security2.10.1-2+deb13u1vulnerable
Debianpyjwtbookworm2.6.0-1+deb12u1vulnerable
Debianpyjwtbookworm-security2.6.0-1+deb12u1vulnerable
PyPIpyjwtNot reported2.14.0fixed
PyPIpyjwtNot reported2.14.0fixed
CpepyjwtNot reported2.14.0fixed
Ubuntupyjwtnoble2.7.0-1ubuntu0.3fixed
Ubuntupython3-jwtnoble2.7.0-1ubuntu0.3fixed
Ubuntupyjwt22.041.7.1-2ubuntu2vulnerable
Ubuntupyjwt22.042.1.0-1vulnerable
Ubuntupyjwt22.042.3.0-1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.2vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.3vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.4vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.5fixed
Ubuntupyjwt24.042.7.0-1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.2vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.3fixed
Ubuntupyjwt26.102.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.102.12.1-1vulnerable
Ubuntupyjwt26.102.13.0-1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1fixed
Ubuntupyjwt26.042.10.1-2vulnerable
Ubuntupyjwt26.042.10.1-3vulnerable
Ubuntupyjwt26.042.10.1-3build1vulnerable
Ubuntupyjwt26.042.10.1-4vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpyjwtsourcesid2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourceforky2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianpyjwtsourcebookworm(unfixed)not yet assignedNot reportedNot reported
PyPIpyjwtPyPINot reported2.14.0Not reportedGHSA-9V7F-9G4P-FFGJNot reported
PyPIpyjwtPyPINot reported2.14.0Not reportedPYSEC-2026-4144Not reported
CpepyjwtcpeNot reported2.14.0Not reportedNVD-CVE-2026-102267Not reported
Ubuntupyjwtdebnoble2.7.0-1ubuntu0.3Not reportedNot reportedNot reported
Ubuntupython3-jwtdebnoble2.7.0-1ubuntu0.3Not reportedNot reportedNot reported
Ubuntupyjwtdeb22.042.3.0-1ubuntu0.5Not reportedUBUNTU-CVE-2026-102267Not reported
Ubuntupyjwtdeb24.042.7.0-1ubuntu0.3Not reportedUBUNTU-CVE-2026-102267Not reported
Ubuntupyjwtdeb26.102.13.0-1ubuntu1Not reportedUBUNTU-CVE-2026-102267Not reported
Ubuntupyjwtdeb26.042.10.1-4ubuntu1.2Not reportedUBUNTU-CVE-2026-102267Not reported

Notes

[bookworm] pyjwt: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.6.0-1+deb12u1 · all · bookworm

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

[Debian 13 (Trixie)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

  • [python-jwt-doc]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]