Skip to content
fr Sign in
7.4 High

CVE-2026-48526 PyJWT is a JSON Web Token implementation in Python

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Affected products and versions

Product Affected versions Fixed in
pyjwt 2.13 earliest → < 2.13.0 2.13.0
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat AI Inference Server 3.3 1782352847 earliest → < 1782352847 1782352847
Red Hat Ansible Automation Platform 2.7 1785435970 earliest → < 1785435970 1785435970
Red Hat Quay 3.12 1781937357 earliest → < 1781937357 1781937357
Red Hat Quay 3.9 1781878070 earliest → < 1781878070 1781878070
Migration Toolkit for Applications 8 Versions not published
OpenShift Lightspeed Versions not published
Show the 45 other branches
Product Affected versions Fixed in
Red Hat AI Inference Server Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Hardened Images Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Update Infrastructure 4 for Cloud Providers Versions not published
Red Hat Quay 3.10 1782487717 earliest → < 1782487717 1782487717
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Satellite 6.19 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 1783969139 earliest → < 1783969139 1783969139
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.2) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.4) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.9.2) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.9.4) Versions not published
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) Versions not published
Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) Versions not published
Red Hat Satellite 6.18 1782739344 earliest → < 1782739344 1782739344
Red Hat OpenShift AI 3.3 1783010225 earliest → < 1783010225 1783010225
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat Quay 3.16 1783955846 earliest → < 1783955846 1783955846
Red Hat Trusted Artifact Signer 1.3 1784016554 earliest → < 1784016554 1784016554
Red Hat Quay 3.1 1782487717 earliest → < 1782487717 1782487717
Red Hat Ansible Automation Platform 2.5 1784046511 earliest → < 1784046511 1784046511
Red Hat OpenShift AI 2.25 1783701598 earliest → < 1783701598 1783701598
Red Hat Migration Toolkit for Applications 8.2 1784109883 earliest → < 1784109883 1784109883
Red Hat Quay 3.15 1784351966 earliest → < 1784351966 1784351966
Red Hat Quay 3.18 1784987273 earliest → < 1784987273 1784987273
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published
Red Hat Trusted Artifact Signer 1.4 1785420425 earliest → < 1785420425 1785420425
Red Hat OpenShift AI 3.4 1787073593 earliest → < 1787073593 1787073593

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pyjwt

The 22 CVEs of pyjwt →
CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards 6.5 Medium CVE-2026-102265 PyJWT is a Python implementation of JSON Web Token standards 5.3 Medium CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards 6.5 Medium CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards 5.9 Medium
Track this CVE