Vulnerability · Published May 28, 2026 · Assigned by GitHub_M
CVE-2026-48526PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
High 7.4
In plain English
A high-severity improper authentication in pyjwt from jpadilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 62.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | fence-agents-aliyun | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-aliyun | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-all | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-all | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-amt-ws | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-amt-ws | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-apc | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-apc | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-apc-snmp | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-apc-snmp | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-aws | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-aws | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-azure-arm | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-azure-arm | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-bladecenter | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-bladecenter | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-brocade | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-brocade | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-cisco-mds | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-cisco-mds | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-cisco-ucs | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-cisco-ucs | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-common | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-common | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:9 | fence-agents-compute | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-drac5 | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-drac5 | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-eaton-snmp | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-eaton-snmp | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-emerson | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-emerson | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-eps | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-eps | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-gce | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-gce | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-heuristics-ping | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-heuristics-ping | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-hpblade | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-hpblade | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ibm-powervs | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ibm-powervs | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ibm-vpc | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ibm-vpc | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ibmblade | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ibmblade | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ifmib | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ifmib | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ilo-moonshot | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ilo-moonshot | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ilo-mp | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ilo-mp | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ilo-ssh | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ilo-ssh | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ilo2 | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ilo2 | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-intelmodular | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-intelmodular | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ipdu | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ipdu | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-ipmilan | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-ipmilan | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-kdump | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-kdump | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-kubevirt | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-kubevirt | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-lpar | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-lpar | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-mpath | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-mpath | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-nutanix-ahv | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-nutanix-ahv | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-openstack | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-openstack | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-redfish | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-redfish | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-rhevm | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-rhevm | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-rsa | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-rsa | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-rsb | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-rsb | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-sbd | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-sbd | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-scsi | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-scsi | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-virsh | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-virsh | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-vmware-rest | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-vmware-rest | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-vmware-soap | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-vmware-soap | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-wti | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-wti | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-agents-zvm | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-agents-zvm | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virt | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virt | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virtd | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virtd | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virtd-cpg | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virtd-cpg | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virtd-libvirt | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virtd-libvirt | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virtd-multicast | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virtd-multicast | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virtd-serial | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virtd-serial | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | fence-virtd-tcp | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | fence-virtd-tcp | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| AlmaLinux:10 | ha-cloud-support | 4.16.0-21.el10_2.2 | ALSA-2026:25902 |
| AlmaLinux:9 | ha-cloud-support | 4.10.0-110.el9_8.3 | ALSA-2026:26206 |
| Debian:12 | pyjwt | no fix listed | DEBIAN-CVE-2026-48526 |
| Debian:13 | pyjwt | no fix listed | DEBIAN-CVE-2026-48526 |
| Debian:14 | pyjwt | 2.13.0-1 | DEBIAN-CVE-2026-48526 |
| PyPI | pyjwt | 2.13.0 | GHSA-xgmm-8j9v-c9wx |
| PyPI | pyjwt | 2.13.0 | PYSEC-2026-179 |
| Rocky Linux:10 | fence-agents | 0:4.16.0-21.el10_2.2 | RLSA-2026:25902 |
| Rocky Linux:9 | fence-agents | 0:4.10.0-110.el9_8.3 | RLSA-2026:26206 |
| Ubuntu:22.04:LTS | pyjwt | 2.3.0-1ubuntu0.4 | USN-8823-1 |
| Ubuntu:22.04:LTS | pyjwt | 2.3.0-1ubuntu0.4 | UBUNTU-CVE-2026-48526 |
| Ubuntu:24.04:LTS | pyjwt | 2.7.0-1ubuntu0.2 | UBUNTU-CVE-2026-48526 |
| Ubuntu:24.04:LTS | pyjwt | 2.7.0-1ubuntu0.2 | USN-8823-1 |
| Ubuntu:25.10 | pyjwt | no fix listed | UBUNTU-CVE-2026-48526 |
| Ubuntu:26.04:LTS | pyjwt | 2.10.1-4ubuntu1.1 | UBUNTU-CVE-2026-48526 |
| Ubuntu:26.04:LTS | pyjwt | 2.10.1-4ubuntu1.1 | USN-8823-1 |
Affected products (as reported)
Weakness: CWE-287, CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-48526 vdb-entry, x_refsource_REDHAT
- RHBZ#2482734 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48526.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:50319 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50223 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50336 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34160 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50222 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50263 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34365 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35845 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25902 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35837 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35836 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35835 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26206 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30089 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30088 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42144 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42132 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34374 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50340 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25928 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42142 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43038 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33683 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30076 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41066 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48085 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28571 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36350 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40967 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50904 vendor-advisory, x_refsource_REDHAT