HMAC Algorithm Vulnerability in PyJWT by Auth0
CVE-2026-48526

7.4HIGH

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
28 May 2026

What is CVE-2026-48526?

The PyJWT library is a widely used implementation for JSON Web Tokens in Python. Prior to version 2.13.0, an improper validation in the decoding phase allowed attackers to exploit the handling of JSON Web Keys when utilizing HMAC algorithms. Specifically, by failing to validate these keys, an attacker could potentially use an issuer's public key as the secret key for HMAC verification. This could compromise the integrity of token validation processes, making unauthorized access to sensitive functionalities possible. Upgrading to version 2.13.0 addresses this security risk.

Affected Version(s)

pyjwt < 2.13.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.