Bug 2482734 (CVE-2026-48526)
| Summary: | CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | alinfoot, anpicker, anthomas, aprice, bbrownin, bdettelb, bparees, cmyers, dfreiber, dnakabaa, doconnor, dranck, drow, dschmidt, dtrifiro, eborisov, ehelms, erezende, ggainey, hasun, ilpinto, jburrell, jfula, jkoehler, jlanda, jmitchel, jowilson, jsamir, juwatts, jwong, kaycoth, kshier, lball, lbrazdil, lcouzens, ljawale, lphiri, ltomasbo, luizcosta, mbarnett, mhayden, mhulan, mminar, ngough, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, osousa, pbohmill, pcreech, ptisnovs, rbiba, rbobbitt, rbryant, rchan, rhel-process-autobot, rjohnson, sdoran, simaishi, smallamp, smcdonal, sskracic, stcannon, syedriko, teagle, tmalecek, tpfromme, ttakamiy, veshanka, vkumar, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-05-28 16:01:45 UTC
|