Is CVE-2026-102267 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102267 being exploited in the wild.

How severe is CVE-2026-102267?

High severity, with a CVSS score of 7.4, published 28 September 2026.

Which products and versions are affected?

PyJWT before 2.14.0; pyjwt (PyPI) <= 2.13.0, ECOSYSTEM:introduced=0,fixed=2.14.0.

Is there a fix for CVE-2026-102267?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102267 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102267?

Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102267: PyJWT open redirect in PyJWKClient JWKS fetches

Q: Is there a fix for CVE-2026-102267?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102267 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102267?

Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102267 · Severity: high · CVSS 7.4 · Published 2026-09-28

PyJWT is a Python library that validates JSON Web Tokens, which are used for authentication and authorization in modern applications. In versions before 2.14.0, PyJWT fails to validate the destination of HTTP redirects when fetching signing keys from a trusted endpoint. An attacker controlling a trusted JWKS server could redirect the client to a malicious server, leading to credential disclosure or substitution of verification keys with attacker-controlled ones, breaking authentication security.

Technologies: PyJWT, pyjwt (PyPI). Vendors: PyJWT, PyPI.

Quick answers

Is CVE-2026-102267 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102267 being exploited in the wild.
How severe is CVE-2026-102267?: High severity, with a CVSS score of 7.4, published 28 September 2026.
Which products and versions are affected?: PyJWT before 2.14.0; pyjwt (PyPI) <= 2.13.0, ECOSYSTEM:introduced=0,fixed=2.14.0.
Is there a fix for CVE-2026-102267?: Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102267 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102267?: Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.14.0 or later
```
pip install "pyjwt>=2.14.0"
```

Technical details

PyJWKClient does not revalidate redirect destinations against the JWKS trust boundary, allowing an attacker-influenced redirect from a configured trusted endpoint to be followed without validation. The vulnerability is triggered when the trusted JWKS endpoint returns an HTTP redirect, which PyJWKClient follows and treats the redirected response as valid key material. This affects JWT verification and can result in key substitution or credential forwarding to untrusted servers; the fix in 2.14.0 rejects all redirects in JWKS fetch operations.

Affected products

PyJWT PyJWT before 2.14.0

Identifiers

CVE-2026-102267
GHSA-9v7f-9g4p-ffgj
PYSEC-2026-4144

Timeline

2026-09-28: disclosed
2026-09-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.