Bug 2482734 (CVE-2026-48526)

Summary: CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: alinfoot, anpicker, anthomas, aprice, aruklets, bbrownin, bdettelb, bparees, cahl, cmyers, dfreiber, dnakabaa, doconnor, dranck, drow, dschmidt, dtrifiro, eborisov, ehelms, erezende, ggainey, hasun, ilpinto, jburrell, jfula, jkoehler, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lball, lbrazdil, lcouzens, ljawale, lphiri, ltomasbo, luizcosta, mbarnett, mdellweg, mhayden, mhulan, mminar, msilmser, ngough, nmoumoul, nweather, nyancey, oezr, omaciel, ometelka, osousa, pcreech, ptisnovs, rbiba, rbobbitt, rbryant, rchan, rhel-process-autobot, rjohnson, sdoran, simaishi, smallamp, smcdonal, sskracic, stcannon, syedriko, teagle, tmalecek, tpfromme, ttakamiy, veshanka, vkumar, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-28 16:01:45 UTC
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Comment 4 errata-xmlrpc 2026-06-15 02:19:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:25902 https://access.redhat.com/errata/RHSA-2026:25902

Comment 5 errata-xmlrpc 2026-06-16 11:50:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:26206 https://access.redhat.com/errata/RHSA-2026:26206

Comment 7 errata-xmlrpc 2026-07-01 11:03:23 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9

Via RHSA-2026:34160 https://access.redhat.com/errata/RHSA-2026:34160

Comment 8 errata-xmlrpc 2026-07-06 03:44:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:35845 https://access.redhat.com/errata/RHSA-2026:35845

Comment 9 errata-xmlrpc 2026-07-06 04:49:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:35836 https://access.redhat.com/errata/RHSA-2026:35836

Comment 10 errata-xmlrpc 2026-07-06 05:14:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:35835 https://access.redhat.com/errata/RHSA-2026:35835

Comment 11 errata-xmlrpc 2026-07-06 05:18:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:35837 https://access.redhat.com/errata/RHSA-2026:35837

Comment 13 errata-xmlrpc 2026-08-04 15:56:49 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:50222 https://access.redhat.com/errata/RHSA-2026:50222

Comment 14 errata-xmlrpc 2026-08-04 15:59:08 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:50223 https://access.redhat.com/errata/RHSA-2026:50223

Comment 15 errata-xmlrpc 2026-08-04 16:07:44 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:50263 https://access.redhat.com/errata/RHSA-2026:50263

Comment 16 errata-xmlrpc 2026-08-04 17:57:17 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:50319 https://access.redhat.com/errata/RHSA-2026:50319

Comment 17 errata-xmlrpc 2026-08-04 18:43:51 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:50336 https://access.redhat.com/errata/RHSA-2026:50336