# CVE-2026-102267: PyJWT open redirect in PyJWKClient JWKS fetches

Source: https://junglewise.ai/threats/cve-2026-102267-pyjwt-is-a-python-implementation-of-json-web-token-standards  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-102267 · Severity: high · CVSS 7.4 · Published 2026-09-28

PyJWT is a Python library that validates JSON Web Tokens, which are used for authentication and authorization in modern applications. In versions before 2.14.0, PyJWT fails to validate the destination of HTTP redirects when fetching signing keys from a trusted endpoint. An attacker controlling a trusted JWKS server could redirect the client to a malicious server, leading to credential disclosure or substitution of verification keys with attacker-controlled ones, breaking authentication security.

Technologies: [PyJWT](https://junglewise.ai/threats/technologies/pyjwt-pyjwt), [pyjwt (PyPI)](https://junglewise.ai/threats/technologies/pypi-pyjwt). Vendors: [PyJWT](https://junglewise.ai/threats/vendors/pyjwt), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-102267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102267 being exploited in the wild.

**How severe is CVE-2026-102267?** High severity, with a CVSS score of 7.4, published 28 September 2026.

**Which products and versions are affected?** PyJWT before 2.14.0; pyjwt (PyPI) <= 2.13.0, ECOSYSTEM:introduced=0,fixed=2.14.0.

**Is there a fix for CVE-2026-102267?** Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102267 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102267?** Check whether you run PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyjwt (PyPI): upgrade to 2.14.0 or later

  ```sh
  pip install "pyjwt>=2.14.0"
  ```


## Technical details

PyJWKClient does not revalidate redirect destinations against the JWKS trust boundary, allowing an attacker-influenced redirect from a configured trusted endpoint to be followed without validation. The vulnerability is triggered when the trusted JWKS endpoint returns an HTTP redirect, which PyJWKClient follows and treats the redirected response as valid key material. This affects JWT verification and can result in key substitution or credential forwarding to untrusted servers; the fix in 2.14.0 rejects all redirects in JWKS fetch operations.

## Affected products

- PyJWT PyJWT before 2.14.0

## Identifiers

- CVE-2026-102267
- GHSA-9v7f-9g4p-ffgj
- PYSEC-2026-4144

## Timeline

- 2026-09-28: disclosed
- 2026-09-11: patched

## References

- [https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56](https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56)
- [https://github.com/jpadilla/pyjwt/releases/tag/2.14.0](https://github.com/jpadilla/pyjwt/releases/tag/2.14.0)

## Related threats

- [PyJWT HS256/384/512 token forgery via empty HMAC key in oct JWK](https://junglewise.ai/threats/pyjwt-hs256-384-512-verify-accepts-empty-hmac-key-via-oct-jwk-pyjwk-a3ba63d2)
- [PyJWT decode() options-dict mutation enabling claim-verification bypass](https://junglewise.ai/threats/cve-2026-103001-pyjwt-decode-reintroduces-options-dict-mutation-enabling-silent)
- [PyJWT OKP algorithm key validation bypass](https://junglewise.ai/threats/cve-2026-102275-pyjwt-is-a-python-implementation-of-json-web-token-standards)
- [PyJWT unhandled ValueError in JWK Set parsing](https://junglewise.ai/threats/cve-2026-102274-pyjwt-is-a-python-implementation-of-json-web-token-standards)
- [PyJWT HMAC key validation bypass in HMACAlgorithm.prepare_key](https://junglewise.ai/threats/cve-2026-102273-pyjwt-is-a-python-implementation-of-json-web-token-standards)