CVE-2026-102267: PyJWT: PyJWKClient follows redirects when fetching JWKS

September 29, 2026

PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host.

References

github.com/advisories/GHSA-9v7f-9g4p-ffgj
github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
github.com/jpadilla/pyjwt/releases/tag/2.14.0
github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj
nvd.nist.gov/vuln/detail/CVE-2026-102267

Code Behaviors & Features

Detect and mitigate CVE-2026-102267 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →