Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101917— PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Quick assessment

Affected
jpadilla pyjwt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PyJWT 是 JSON Web Token 标准的 Python 实现。在版本 2.14.0 之前，PyJWT 的 函数存在缺陷：当遇到未知的 （密钥标识符）时，若缺少负缓存（negative cache）或最小刷新间隔机制，将强制执行刷新操作。该问题出现在未认证的令牌重复使用同一个未知的 ，或使用缓存的 JWKS（JSON Web Key Set）中不存在的多个不同 值的情况下。每次缓存未命中都会导致 刷新 JWKS，从而使得攻击者可以通过构造特定流量，放大对配置的 JWKS 端点的出站请求。该问题已在 2.1

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101917

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Source: CVE Program / CVE List V5
Vulnerability Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jpadilla pyjwt < 2.14.0 -

II. Public POCs for CVE-2026-101917

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101917

请登录查看更多情报信息。

Other References for CVE-2026-101917 (3)

Same Patch Batch · jpadilla · 2026-09-28 · 13 CVEs total

CVE-2026-102268 9.1 CRITICAL PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip th
CVE-2026-102266 7.4 HIGH PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
CVE-2026-102267 7.4 HIGH PyJWT: PyJWKClient follows redirects when fetching JWKS
CVE-2026-102271 7.4 HIGH PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217
CVE-2026-102272 7.4 HIGH PyJWT BOM Bypass
CVE-2026-102273 7.4 HIGH PyJWT accepts public JWK containers as HMAC secrets
CVE-2026-102275 6.5 MEDIUM PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
CVE-2026-102274 5.9 MEDIUM PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
CVE-2026-101918 5.3 MEDIUM PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.g
CVE-2026-102265 5.3 MEDIUM PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
CVE-2026-102269 4.8 MEDIUM PyJWT: Non-canonical signature segments enable raw-token revocation bypass
CVE-2026-102270 4.4 MEDIUM PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

IV. Related Vulnerabilities

Same product: pyjwt
Same vendor: jpadilla
Same weakness: CWE-770

V. Comments for CVE-2026-101917

No comments yet

Leave a comment