PyJWT <=2.12: HMAC verifier may use issuer JWK as secret key
CVE-2026-48526 Published on May 28, 2026

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

NVD

Vulnerability Analysis

CVE-2026-48526 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-48526. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Types

What is an authentification Vulnerability?

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

CVE-2026-48526 has been classified to as an authentification vulnerability or weakness.

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.


Products Associated with CVE-2026-48526

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Enterprise Linux (RHEL)
 
Red Hat Ai Inference Server
 
Red Hat Ansible Automation Platform
 
Red Hat Quay
 
Red Hat Migration Toolkit Applications
 
Red Hat Openshift Lightspeed
 
Red Hat Enterprise Linux Ai
 
Red Hat Hummingbird
 
Red Hat Openshift Ai
 
Red Hat Satellite
 
Red Hat Trusted Artifact Signer
 
Red Hat Rhui
 

Affected Versions

jpadilla pyjwt: Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream (v. 9): Red Hat AI Inference Server 3.3: Red Hat Ansible Automation Platform 2.7: Red Hat Quay 3.12: Red Hat Quay 3.9: Red Hat Migration Toolkit for Applications 8: Red Hat OpenShift Lightspeed: Red Hat AI Inference Server: Red Hat Ansible Automation Platform 2: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Hardened Images: Red Hat OpenShift AI (RHOAI): Red Hat Quay 3: Red Hat Satellite 6: Red Hat Trusted Artifact Signer: Red Hat Update Infrastructure 4 for Cloud Providers:

Exploit Probability

EPSS
0.15%
Percentile
4.36%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.