PyJWT CVE-2026-48524

Exploitation requires that the target application uses PyJWT's PyJWKClient class and calls get_signing_key() with JWT input that includes attacker-controlled kid header values - meaning the application must accept externally-supplied JWTs for JWKS-backed verification without first validating or allowlisting the kid field. The CVSS vector PR:N confirms that no authentication to the target application is required; any party able to submit HTTP requests carrying JWT tokens is a potential attacker. Exploitation is constrained by AC:H: the actual availability impact depends on the upstream JWKS endpoint being susceptible to elevated request rates (rate limiting, transient errors), which is outside the attacker's direct control. Applications that enforce an explicit kid allowlist, apply per-source rate limiting on token verification, cache JWKS responses with sufficient TTL, or deploy the fixed version 2.13.0 are not practically exploitable via this path.

The CVSS score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects constrained real-world risk. Network attack vector (AV:N) and no privileges required (PR:N) confirm that any unauthenticated actor capable of submitting JWTs to the target application can initiate the attack. However, high attack complexity (AC:H) is the decisive limiting factor: the attacker cannot independently cause JWKS fetch failures - they depend on the upstream identity provider's response to elevated request volume, which is outside the attacker's direct control. The impact ceiling is low availability degradation (A:L) with zero confidentiality or integrity risk. No EPSS data was provided, so probability-of-exploitation scoring cannot be assessed. The CVE is not listed in CISA KEV and no public exploit exists, consistent with the low CVSS score. This is a genuine low-priority finding for most deployments; it elevates to moderate concern only for high-throughput public-facing APIs that rely on PyJWKClient without application-layer rate limiting and whose JWKS providers lack robust upstream throttling.

An attacker targeting a public REST API that uses PyJWKClient for JWT verification generates a high volume of JWT-shaped tokens, each with a unique random kid value that does not exist in the identity provider's JWKS. Each token causes the application to make a distinct outbound HTTP GET to the JWKS URI. If the identity provider begins rate-limiting these requests or experiences transient degradation, subsequent legitimate token verifications fail, resulting in authentication errors for real users. No public exploit code exists, and replicating the impact in practice requires the attacker to overwhelm or destabilize the upstream JWKS provider.