SUSE-SU-2026:22138-1: python-PyJWT&distro=SUSE Linux Micro 6.1 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:22138-1 is a vulnerability in python-PyJWT&distro=SUSE Linux Micro 6.1 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 16-06-2026
   PublishedVulnerability first disclosed.
2. 18-06-2026
   Last modifiedVulnerability information updated.

Description

Security update for python-PyJWT This update for python-PyJWT fixes the following issues - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for SSRF and token forgery (bsc#1266798). - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()` are called with a PyJWK key (bsc#1266799). - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()` leads to unbounded JWKS endpoint requests and DoS (bsc#1266800). - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS allows for DoS (bsc#1266801). - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens allows for forged HS256 tokens (bsc#1266802).

No weakness data has been published for this record.