FlawAtlas
Search the atlas
SUSE-SU-2026:2626-1 Not scored

Security update for python-PyJWT

This update for python-PyJWT fixes the following issues - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for SSRF and token forgery (bsc#1266798). - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()` are called with a PyJWK key (bsc#1266799). - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()` leads to unbounded JWKS endpoint requests and DoS (bsc#1266800). - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS allows for DoS (bsc#1266801). - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens allows for forged HS256 tokens (bsc#1266802).

Exploit probability Not scored
Published June 25, 2026
Required by Not available
Last source change June 26, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS python-PyJWT
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS python-PyJWT
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS python-PyJWT
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS python-PyJWT
SUSE:Linux Enterprise Module for Public Cloud 15 SP4 python-PyJWT
SUSE:Linux Enterprise Module for Python 3 15 SP7 python-PyJWT
SUSE:Linux Enterprise Server 15 SP4-LTSS python-PyJWT
SUSE:Linux Enterprise Server 15 SP5-LTSS python-PyJWT
SUSE:Linux Enterprise Server 15 SP6-LTSS python-PyJWT
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 python-PyJWT
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 python-PyJWT
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 python-PyJWT

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2026:2626-1

This update for python-PyJWT fixes the following issues - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for SSRF and token forgery (bsc#1266798). - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()` are called with a PyJWK key (bsc#1266799). - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()` leads to unbounded JWKS endpoint requests and DoS (bsc#1266800). - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS allows for DoS (bsc#1266801). - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens allows for forged HS256 tokens (bsc#1266802).

View original source

05 / REFERENCES

Further evidence