CVE-2026-102267: jpadilla pyjwt
CVSS: 9.1v3.1CriticalAnalyzed
AliasesGHSA-9v7f-9g4p-ffgjPYSEC-2026-4144UBUNTU-CVE-2026-102267DEBIAN-CVE-2026-102267CGA-4592-v2rg-m5hgCGA-49wj-ggv2-jwhvCGA-4fx9-jp8v-296pCGA-6fgc-5j89-3r47CGA-7gwv-9jq5-4fqpCGA-9658-m3gp-xq4xCGA-c76h-f98c-ww7xCGA-ccp7-rw29-5rphCGA-f6v3-45rc-pp47CGA-g2xh-6w87-xpw2CGA-j4rw-jf3j-9jg9CGA-jjjg-284h-8hhfCGA-pq3h-4cq3-qh6rCGA-q2vf-42q9-h326CGA-qrg2-c6v3-r6hwCGA-r573-hrv8-997pCGA-rvv6-6gcq-2hw6CGA-vrww-6hch-xprmCGA-w998-24fr-grxjCGA-wc65-55hm-96hrCGA-wq97-c724-24pxCGA-x3jg-wfm2-w88wCGA-26p8-49mc-9f37CGA-293h-3hxp-6gfvCGA-29fr-334x-pp2rCGA-29xp-pwf6-88h8CGA-2hx4-xwxf-84jwCGA-2pg6-jj23-873rCGA-2vv7-q4wg-h6gvCGA-33xq-3jxx-4mrvCGA-3g4v-gpgf-f22qCGA-44qm-9wv3-vqx3CGA-49p3-6g75-7x6fCGA-4c6x-fqvr-2cfqCGA-4j5c-hw2r-7wr8CGA-4jmc-xr27-v776CGA-5985-x25j-6vg3CGA-59vm-x5jm-hp26CGA-5cw8-8xvp-69x4CGA-5f7p-m58w-x8q8CGA-5hq5-24hx-2jhjCGA-5mwx-2frw-g78qCGA-5whm-q292-vmwxCGA-6642-2m7g-x3hgCGA-694p-vrmr-5p2vCGA-6wpw-v9r6-r2qgCGA-7cqq-rhq3-83qfCGA-7fh8-8q79-vqhjCGA-7fr2-2php-gj3vCGA-7mcc-xmw5-cp72CGA-7mj6-89wf-f8wpCGA-7w38-vx49-hqfcCGA-855q-mgh6-c32gCGA-8gw9-34wj-grchCGA-8pww-gf3j-qxpjCGA-8r2m-949m-f82pCGA-8vw2-qc7p-54mvCGA-9562-xjgm-v7jjCGA-9778-jgvj-fvv9CGA-9838-3x34-492wCGA-9cx9-m754-hqgxCGA-9m89-jqf4-fp5cCGA-9p4f-gh86-4v2cCGA-c4hw-qxp8-h433CGA-c5h4-9q36-pqgfCGA-c5jj-wpv5-c593CGA-f5hf-68pr-5mh8CGA-fqrx-2996-2fhcCGA-fv4x-7cpm-8583CGA-fvg2-6px4-7m99CGA-fxxj-2vhf-2p72CGA-g9r2-p57h-88w5CGA-gc5h-8v5x-2p4qCGA-gm4p-vvj4-58wwCGA-gqvm-wwxc-vx2qCGA-gw3h-gp78-mqw6CGA-h2g6-jqmj-r9w4CGA-h7cm-c3g5-rchpCGA-h988-vfgj-q7vwCGA-hhg9-mw98-v26wCGA-hjv3-9x6p-q7v2CGA-hmqj-6hq5-xxh6CGA-hqm9-m3m8-jqq5CGA-hv43-pc86-6736CGA-j2q8-c7j5-rh47CGA-j52p-jcm6-h77wCGA-j5q5-jgwg-phrxCGA-j8hx-xxwm-hgqxCGA-jmv5-8862-wphgCGA-jp22-gmmj-q9hpCGA-jppv-3pm4-pmfvCGA-jq6c-crpx-4mm9CGA-jvh6-44cr-6853CGA-jwm9-63x7-q34mCGA-jwp7-35gr-7xrjCGA-m7rc-24x3-vw7fCGA-mfxm-hrrh-h3wjCGA-mh7p-j3c3-c8mrCGA-p2vj-mmmj-m7w5CGA-p3c9-8rrc-9wxfCGA-p3jc-c5ff-339hCGA-pmvx-83f2-w74pCGA-pxc5-j33x-r483CGA-pxqj-8pq2-gv7gCGA-q325-c5x3-fj22CGA-q35p-gw57-9jwhCGA-q3v3-p2h2-p65xCGA-q3wg-5xp4-jfrvCGA-q49h-7j9q-7hc9CGA-q9hg-hr5r-6j77CGA-qcrf-8q2c-mxqjCGA-qfwj-89j7-2qqhCGA-qgpr-c76c-x4f6CGA-qhp4-m2j6-f84mCGA-qp27-frr8-3ww2CGA-qv94-vj27-x994CGA-qxh3-fw7c-qwxwCGA-qxw2-vc34-mm2pCGA-rc23-ffv7-4h6pCGA-rqwj-89h9-673xCGA-rr4q-qjfw-hrrgCGA-v5j5-3vfg-4gcfCGA-v6jh-7j2w-xx7wCGA-v7pw-cqc7-93ppCGA-v99h-6jwh-5qwrCGA-v9mf-vf2f-47pcCGA-vc54-mq4c-g572CGA-vghq-6xcp-x9rmCGA-vmr4-jj6x-v4gjCGA-vwhc-jvph-q5h3CGA-w288-fc42-2wjwCGA-wpj7-6xx2-r735CGA-wpj7-f7xh-m3xjCGA-wrmw-rqgx-9f63CGA-x56g-8c6f-3p58CGA-x7gw-gch2-rgc4CGA-x92q-4wrg-w74cCGA-xcrh-hfv4-hpj8CGA-xh6v-cm86-5qfcCGA-xmq2-rx4w-w2rfCGA-xrqw-qqpx-gphvCGA-xx87-2vp8-9w9p
Published 28-09-2026Last modified 01-10-2026
Vulnerability summary
CVE-2026-102267 is a critical (CVSS 9.1) vulnerability in jpadilla pyjwt. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.5% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
0.16%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 01-10-2026Last modifiedVulnerability information updated.
Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSources7 sources · 7.4–9.1
- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · PypiEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
29-09-202619-10-2026
EPSS score0.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Chainguard79 products
- airflow-2< 2.11.2-r25
- airflow-core-2< 2.11.2-r10 | All versions (No fix recorded)
- authentik-2026.5< 2026.5.7-r4
- authentik-fips-2026.5< 2026.5.7-r7
- azureml-inference-server-httpAll versions (No fix recorded)
Wolfi12 products
- datadog-agent-7.77-core-integrations< 7.77.3-r26
- datadog-agent-7.78-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.79-core-integrations< 7.79.2-r20
- datadog-agent-7.80-core-integrations< 7.80.4-r19
- datadog-agent-7.81-core-integrations< 7.81.3-r8
Debian1 product
- pyjwtAll versions (No fix recorded) | < 2.14.0-1
Jpadilla1 product
- pyjwt< 2.14.0
Pyjwt_project1 product
- pyjwt< 2.14.0
PyPI1 product
- pyjwt< 2.14.0
Ubuntu1 product
- pyjwtAll versions (No fix recorded)
7 vendors · 96 products
References
11 links- github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgjX Refsource CONFIRMWEBREPORTAdvisoryPatchVendor Advisory
- github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56X Refsource MISCWEBREPORTFIXPatch
- github.com/jpadilla/pyjwtPACKAGE
- pypi.org/project/pyjwtPACKAGE
