CVE-2026-48523: PyJWT Algorithm Bypass in JWK Verification (2.9.0–2.12.1)

Technical summary

The vulnerability lies in a logic gap between algorithm validation and signature verification in PyJWT's jwt.decode() and jwt.decode_complete() functions when called with PyJWK objects. The library performs two distinct algorithm checks: it validates the 'alg' claim in the JWT header against the caller-supplied algorithms allow-list, which appears to implement proper access control. However, the actual cryptographic signature verification is performed using the algorithm bound to the PyJWK object itself, not the header algorithm. This creates a bypass: an attacker holding a registered private key can sign a token using any algorithm available in their JWK object (including disallowed algorithms), set the JWT header's 'alg' field to an allowed algorithm, and pass both the header validation and signature verification. The flaw is particularly impactful in the documented PyJWKClient.get_signing_key_from_jwt() workflow, which is designed to retrieve and validate signing keys from JWKS endpoints. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), where the signature verification mechanism fails to authenticate the algorithm it applies.

Business impact

Organizations relying on PyJWT for token validation in authentication, authorization, or API security contexts face a privilege escalation and authentication bypass risk. If an attacker controls or compromises a registered JWK/JWKS private key, they can forge valid-appearing tokens that circumvent the application's algorithm restrictions. This is especially critical in microservices and OAuth/OIDC implementations where PyJWT validates tokens from trusted key sets. The breach could allow unauthorized access to protected resources, lateral movement within systems that trust these tokens, and potential elevation of privileges if tokens contain role or permission claims. The risk is amplified in systems that explicitly configure restrictive algorithm allow-lists—a common hardening practice—because the allow-list provides a false sense of security that is bypassed by this flaw.

Affected systems

Any application using PyJWT versions 2.9.0 through 2.12.1 is affected. The vulnerability is triggered specifically when jwt.decode() or jwt.decode_complete() are called with a PyJWK object as the key parameter. Applications that use PyJWKClient (the recommended client for JWKS endpoint integration) are directly impacted. Python environments across all operating systems are vulnerable if they run affected PyJWT versions. Verify your application's dependency manifest (requirements.txt, setup.py, poetry.lock, etc.) to identify affected versions. Applications using only string-based keys (raw key material rather than PyJWK objects) are not vulnerable.

Exploitability

Exploitation requires the attacker to possess or control a registered JWK/JWKS private key—that is, a key that is already trusted and published in the application's key set. The attack does not require interaction from users (UI:N) and can be executed over the network (AV:N) by any authenticated or semi-privileged principal (PR:L). No special timing or conditions are needed (AC:L). The CVSS score of 5.4 MEDIUM reflects that while the technical bar to exploitation is low once a key is compromised, the prerequisite of key compromise limits the immediate threat. However, in scenarios where an attacker has already obtained a signing key (e.g., through a developer system compromise or insider threat), the exploit is trivial and requires no additional vulnerabilities.

Remediation

Upgrade PyJWT to version 2.13.0 or later immediately. This version corrects the algorithm verification logic to ensure that signature verification uses the algorithm specified in the JWT header, not the algorithm bound to the JWK object. After upgrading, restart all applications and services that depend on PyJWT. Verify the upgrade in all environments: development, staging, and production. Additionally, conduct a key rotation audit: if you suspect any JWK/JWKS private keys may have been compromised, rotate them and re-issue any tokens signed with old keys. Review application logs and token audit trails for anomalies dating back to when your affected version was deployed.

Patch guidance

Upgrade PyJWT as follows: For pip-based projects, run 'pip install --upgrade pyjwt>=2.13.0'. For projects using requirements.txt, update the line to 'pyjwt>=2.13.0' and reinstall. For Poetry users, run 'poetry update pyjwt'. For Pipenv, run 'pipenv update pyjwt'. Verify the installation with 'python -c "import jwt; print(jwt.__version__)"' to confirm version 2.13.0 or higher is in use. Test your application's token validation flows in a staging environment before deploying to production. If you maintain a software bill of materials (SBOM), update PyJWT's entry accordingly.

Detection guidance

Check your environment for PyJWT versions 2.9.0–2.12.1 using dependency scanning tools (e.g., pip freeze, poetry show, Snyk, OWASP Dependency-Check). In your application code, search for jwt.decode() and jwt.decode_complete() calls that accept PyJWK or PyJWKClient objects; these are the vulnerable call patterns. If you have token validation logs or metrics, look for tokens with header algorithm claims that differ from your configured allow-list (though the bug masks this at validation time). Network-based detection is difficult without code inspection, as the vulnerability produces no obvious network signatures. Focus on inventory and code review rather than network detection.

Why prioritize this

This vulnerability should be prioritized for immediate patching in any environment where PyJWT versions 2.9.0–2.12.1 are in use, particularly if those environments handle authentication or authorization tokens. Although the CVSS score is MEDIUM and KEV status is not published, the combination of high practical impact (authentication bypass), low exploitation complexity, and ease of remediation (a simple version bump) makes this a high-priority update. Organizations that have explicitly configured restrictive algorithm allow-lists should prioritize even more heavily, as the flaw directly undermines that security control. The window between the vulnerable versions (introduced in 2.9.0 and fixed in 2.13.0) is approximately 4 versions, suggesting the issue may have been in the wild for months.

Risk score, explained

The CVSS 5.4 MEDIUM score reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires low privileges (PR:L) but delivers only partial confidentiality and integrity impact (C:L/I:L/A:N). However, this score may understate the practical risk in certain contexts. If a JWK/JWKS private key is compromised—a plausible scenario in supply-chain, insider threat, or developer workstation compromise incidents—an attacker gains a trivial method to forge tokens that bypass security controls. The requirement for authentication (PR:L) is a mitigating factor because it implies the attacker already has some level of access; however, in federated or OAuth scenarios, 'authentication' may include external parties or compromised third-party services. Organizations should assess their own risk tolerance based on the sensitivity of what tokens protect and the likelihood of key compromise in their threat model.

Frequently asked questions