PyJWT: PyJWKClient follows redirects when fetching JWKS

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.1

[ Description ]Official description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

[ Fixes ]Fixes and patches

• PyJWT 2.14.0Fixed version · GitHub Advisories · pip package PyJWT: upgrade to 2.14.0 or later (affected <= 2.13.0)
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4111

  Red Hat Ansible Automation Platform: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-11332CVE-2026-102938CVE-2026-103262+21 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs

[ Packages ]Affected open-source packages

• PyJWT pipAffected <= 2.13.0 · fixed in 2.14.0 · GHSA-9v7f-9g4p-ffgj

[ References ]References

• github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56Patch
• github.com/jpadilla/pyjwt/releases/tag/2.14.0ProductRelease Notes
• github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgjPatchVendor Advisory