Fluid Attacks Database

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel10	fence-agents	<0:4.16.0-21.el10_2.2	0:4.16.0-21.el10_2.2
pypi	pyjwt	>=0 <2.13.0	2.13.0
debian 13	pyjwt	=2.10.1-2 \|\| =2.10.1-2+deb13u1 \|\| =2.10.1-3 \|\| =2.10.1-4 \|\| =2.11.0-2 \|\| =2.12.1-1 \|\| =2.13.0-1	-
debian 14	pyjwt	=2.10.1-2 \|\| =2.10.1-3 \|\| =2.10.1-4 \|\| =2.11.0-2 \|\| =2.12.1-1 \|\| >=0 <2.13.0-1	2.13.0-1
debian 12	pyjwt	=2.10.1-1 \|\| =2.10.1-2 \|\| =2.10.1-3 \|\| =2.10.1-4 \|\| =2.11.0-2 \|\| =2.12.1-1 \|\| =2.13.0-1 \|\| =2.6.0-1 \|\| =2.6.0-1+deb12u1 \|\| =2.7.0-1	-
rpm rhel9	fence-agents	<0:4.10.0-110.el9_8.3	0:4.10.0-110.el9_8.3
rpm rhel10.0	fence-agents	<0:4.16.0-5.el10_0.11	0:4.16.0-5.el10_0.11
rpm rhel9.6	fence-agents	<0:4.10.0-86.el9_6.18	0:4.10.0-86.el9_6.18

Aliases

1. CVE-2026-485262. NVD-2026-485263. OSV-2026-485264. OSV-DEBIAN-2026-485265. GHSA-xgmm-8j9v-c9wx6. GCVE-2026-485267. SECURITY-TRACKER-CVE-2026-48526

References

1. https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx2. https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-179.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.