CVE-2026-102267

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set (JWKS) endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an untrusted server, allowing the client to accept forged verification keys or potentially exposing sensitive credentials.

This vulnerability is rated as an Important impact because improper handling of HTTP redirects during dynamic key retrieval can allow an adversary to supply forged cryptographic keys or intercept sensitive request headers. In Red Hat environments where services utilize PyJWKClient to fetch JSON Web Key Sets over the network, accepting untrusted key material may compromise token validation and authentication boundaries. Exploitation requires the target service to dynamically resolve keys via HTTP and relies on an attacker's ability to manipulate responses returned by the configured key server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.