CVE-2026-48524

A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. A remote attacker can exploit this vulnerability by sending specially crafted JWTs with unknown 'kid' (key ID) values. This can force the PyJWKClient.get_signing_key() function to make an unlimited number of unrate-limited HTTP requests to the JSON Web Key Set (JWKS) endpoint. This could potentially lead to a denial of service against the JWKS endpoint, depending on its rate limiting and error handling capabilities.

Moderate: A flaw in PyJWT, as used in Red Hat products like Ansible Automation Platform and Red Hat Satellite, allows a remote attacker to trigger an unrate-limited volume of HTTP requests to a JSON Web Key Set (JWKS) endpoint. This occurs when processing specially crafted JSON Web Tokens with unknown key IDs, potentially leading to a denial of service against the external JWKS infrastructure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.