CVE-2026-48523

A flaw was found in PyJWT, a Python library for handling JSON Web Tokens (JWT). An attacker with control over a registered JSON Web Key (JWK) private key can bypass security checks by signing a token with a forbidden algorithm while claiming to use an allowed one. This allows the attacker to have the token accepted, potentially leading to unauthorized access or manipulation of sensitive information.

This flaw is rated as Moderate. It impacts applications using PyJWT with PyJWK keys, specifically when jwt.decode() or jwt.decode_complete() are called with a PyJWK key and the PyJWKClient.get_signing_key_from_jwt flow. An attacker must control a registered JWK private key to bypass algorithm allow-lists, limiting the exploitability in environments with strict key management.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.