CVE-2026-48523

{
  "id": "CVE-2026-48523",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-28T16:16:29.280",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0."
    },
    {
      "lang": "es",
      "value": "PyJWT es una implementación de JSON Web Token en Python. Desde 2.9.0 hasta 2.12.1, existe una omisión de la lista de algoritmos permitidos del lado del verificador cuando se llama a jwt.decode() o jwt.decode_complete() con una clave PyJWK. El ’alg’ del encabezado del token se verifica contra la lista de algoritmos permitidos proporcionada por el llamador, pero la verificación de la firma se realiza con el algoritmo vinculado al objeto PyJWK en lugar del algoritmo del encabezado. Un atacante que controla una clave privada JWK/JWKS registrada puede firmar con un algoritmo no permitido, anunciar un algoritmo permitido en el encabezado JWT y aun así ser aceptado. El problema afecta el flujo documentado PyJWKClient.get_signing_key_from_jwt(...). Esta vulnerabilidad está corregida en 2.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jpadilla",
          "product": "pyjwt",
          "versions": [
            {
              "version": ">= 2.9.0, < 2.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T15:27:44.771049Z",
          "id": "CVE-2026-48523",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.9.0",
              "versionEndExcluding": "2.13.0",
              "matchCriteriaId": "9EB72189-9128-4C8F-83EB-B3465C239F6D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}