Token Refresh Vulnerability in PyJWT by JPadilla

CVE-2026-101917

What is CVE-2026-101917?

The PyJWT library, a popular implementation for JSON Web Tokens, contains a vulnerability in the get_signing_key_from_jwt function prior to version 2.14.0. This issue arises when unauthenticated tokens repeatedly utilize the same unknown kid or varying kid values that are not present in the cached JSON Web Key Set (JWKS). Each cache miss prompts the PyJWKClient to refresh the JWKS, potentially leading to an escalation of outbound requests to the specified JWKS endpoint. The vulnerability has been addressed in version 2.14.0, highlighting the need for users to upgrade to this version to ensure the integrity of token handling.

References