Executive brief
A vulnerability in the PyJWT library allows attackers to trick the system into reading local files or connecting to unintended internal services. This occurs when the library processes security keys from a web address provided in a token without checking if that address is a standard website. In specific configurations, an attacker could use this to bypass security checks and forge valid-looking login tokens.
Technical details
The PyJWKClient class in PyJWT passes the 'uri' argument directly to Python's urllib.request.urlopen() without validating the protocol scheme. By default, this allows the use of FileHandler, FTPHandler, and DataHandler. An attacker who can influence the 'jku' (JWK Set URL) parameter in a JWT header can trigger an SSRF to read local files or interact with internal network services. If the attacker also has write access to a location reachable via these schemes, they can provide a malicious JWK set to forge tokens that the library will verify as authentic. The fix introduces an 'allowed_schemes' parameter defaulting to ('https', 'http').
Affected products
- jpadilla PyJWT <= 2.12.1
Timeline
- 2026-05-06: other: Vulnerability verified by researcher
- 2026-05-21: disclosed: Advisory published on GitHub
- 2026-06-15: advisory: Advisory updated with CVE-2026-48522