CVE-2026-48522

A flaw was found in PyJWT, a JSON Web Token implementation in Python. The PyJWKClient component, prior to version 2.13.0, directly passes its Uniform Resource Identifier (URI) argument to urllib.request.urlopen(). This allows a remote attacker, by influencing the application's jku URL ingestion path, to perform Server-Side Request Forgery (SSRF) attacks, potentially leading to the reading of arbitrary local files or broader network access. This vulnerability could also enable attackers to forge tokens that PyJWT verifies as legitimate.

This Moderate severity vulnerability in PyJWT's PyJWKClient component allows for Server-Side Request Forgery (SSRF) if an application processes attacker-controlled jku URLs. While the flaw enables reading local files or broader network access, successful token forging requires additional application-layer vulnerabilities, such as untrusted jku derivation or attacker write access to a filesystem path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.