AZL-104979

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104979.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-104979

Upstream

CVE-2026-102267

Published

2026-09-28T21:17:14Z

Modified

2026-09-29T14:16:26Z

Summary

CVE-2026-102267 affecting package python-jwt 2.13.0-1

Details

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102267

Affected packages

Azure Linux:3 / python-jwt

Package

Name: python-jwt
Purl: pkg:rpm/azure-linux/python-jwt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.13.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104979.json"