CVE-2026-48526

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

HIGH

7.4

CVSS Score

Published: May 28, 2026 at 03:09 PM UTC

Updated: October 26, 2026 at 01:10 PM UTC

7 products affected across 3 vendorsPyjwtPyjwtOpenShift AI

Using pyjwt by jpadilla?

Get instant alerts when new vulnerabilities affect pyjwt - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 0.4%

SSVC

PoC

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Pyjwt · Pyjwt Project

95%

v < 2.13.0

Affected range stops below 2.13.0, so it looks safe — our inference, not a vendor statement

Pyjwt · Jpadilla

90%

v < 2.13.0

Affected range stops below 2.13.0, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1782352847 (unaffected)

Vendor states this is fixed in 1782353093 (unaffected)

Ansible Automation Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:2.13.0-1.el9ap (unaffected)

Vendor states this is fixed in 0:4.6.31-1.el8ap (unaffected)

Vendor states this is fixed in 0:4.6.31-1.el9ap (unaffected)

Vendor states this is fixed in 0:4.7.15-2.el9ap (unaffected)

Vendor states this is fixed in 1781025813 (unaffected)

Vendor states this is fixed in 1781030318 (unaffected)

Vendor states this is fixed in 1781042555 (unaffected)

Vendor states this is fixed in 1781102816 (unaffected)

Vendor states this is fixed in 1781118924 (unaffected)

Vendor states this is fixed in 1782650747 (unaffected)

Vendor states this is fixed in 1782712006 (unaffected)

Vendor states this is fixed in 1782755166 (unaffected)

Vendor states this is fixed in 1782761510 (unaffected)

Vendor states this is fixed in 1783920542 (unaffected)

Vendor states this is fixed in 1783969139 (unaffected)

Vendor states this is fixed in 1783979593 (unaffected)

Vendor states this is fixed in 1783981617 (unaffected)

Vendor states this is fixed in 1784046511 (unaffected)

Vendor states this is fixed in 1784050598 (unaffected)

Vendor states this is fixed in 1785378052 (unaffected)

Vendor states this is fixed in 1785435970 (unaffected)

Vendor states this is fixed in 2 (unaffected)

Enterprise Linux AI · Red Hatrpm

60%

OpenShift AI · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1783010225 (unaffected)

Vendor states this is fixed in 1783024305 (unaffected)

Vendor states this is fixed in 1783701598 (unaffected)

Vendor states this is fixed in 1786613209 (unaffected)

Vendor states this is fixed in 1786635926 (unaffected)

Vendor states this is fixed in 1787073451 (unaffected)

Vendor states this is fixed in 1787073459 (unaffected)

Vendor states this is fixed in 1787073546 (unaffected)

Vendor states this is fixed in 1787073593 (unaffected)

Vendor states this is fixed in 1787073605 (unaffected)

Vendor states this is fixed in 1787073611 (unaffected)

Vendor states this is fixed in 1787073713 (unaffected)

Vendor states this is fixed in 1787073717 (unaffected)

Vendor states this is fixed in 1787073866 (unaffected)

Vendor states this is fixed in 1787073873 (unaffected)

Vendor states this is fixed in 1787074331 (unaffected)

Vendor states this is fixed in 1787121387 (unaffected)

Vendor states this is fixed in 1787169432 (unaffected)

OpenShift Lightspeed · Red Hatrpm

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references