CVE-2026-102267

{
  "etk_id": "ETK-2026-21",
  "cve_id": "CVE-2026-102267",
  "display_id": "CVE-2026-102267",
  "ghsa_id": "GHSA-9v7f-9g4p-ffgj",
  "euvd_id": "EUVD-2026-88534",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unvalidated JWKS redirect handling in PyJWT PyJWKClient",
  "summary": "PyJWT through 2.13.0 allows PyJWKClient to follow redirects when retrieving JWKS data without validating the new destination. An attacker able to influence a configured JWKS endpoint's redirect may cause request headers to reach another host or cause untrusted key material to be used, potentially enabling acceptance of forged tokens. Exploitation requires control over, or influence on, redirects returned by the configured JWKS endpoint; a token key identifier alone is insufficient.",
  "mitigation": "Upgrade PyJWT to version 2.14.0 or later. Until upgraded, restrict configured JWKS endpoints to trusted services and prevent them from returning attacker-influenced redirects.",
  "vendor": "pip",
  "product": "pip:PyJWT",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.13.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.14.0"
      ],
      "package_name": "PyJWT",
      "purl": "pkg:pypi/PyJWT"
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0016,
  "epss_percentile": 0.046,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.361304766666667,
  "t0_at": "2026-09-28T20:23:33.556000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-28T20:23:33.556000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T20:23:33.556000+00:00",
      "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj"
    }
  }
}