Is CVE-2026-48526 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48526 being exploited in the wild.

How severe is CVE-2026-48526?

High severity, with a CVSS score of 7.4, published 28 May 2026.

Which products and versions are affected?

pyjwt (PyPI) ECOSYSTEM:introduced=0,fixed=2.13.0.

Is there a fix for CVE-2026-48526?

Yes. pyjwt (PyPI): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48526 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48526?

Check whether you run pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48526: PyJWT algorithm confusion via JSON Web Keys

CVE-2026-48526 · Severity: high · CVSS 7.4 · Published 2026-05-28

PyJWT is a popular Python library used to handle digital identity tokens (JWTs) for user authentication and authorization. A security flaw allows attackers to bypass security checks by tricking the system into using a public key as a secret password. This could allow an unauthorized person to forge identity tokens and gain full access to user accounts or administrative functions.

Technologies: pyjwt (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48526 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48526 being exploited in the wild.
How severe is CVE-2026-48526?: High severity, with a CVSS score of 7.4, published 28 May 2026.
Which products and versions are affected?: pyjwt (PyPI) ECOSYSTEM:introduced=0,fixed=2.13.0.
Is there a fix for CVE-2026-48526?: Yes. pyjwt (PyPI): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48526 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48526?: Check whether you run pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.13.0 or later
```
pip install "pyjwt>=2.13.0"
```

Technical details

A vulnerability in PyJWT's token verification logic allows for a JWT algorithm confusion attack. When a verifier is configured to allow both symmetric (HMAC) and asymmetric (RSA/ECDSA) algorithms and receives a public key in JSON Web Key (JWK) format, the library fails to prevent the JWK from being used as the shared secret for HMAC verification. An attacker can craft a token using the 'HS256' algorithm signed with the issuer's public JWK string. If the application passes this JWK to the decode function while allowing mixed algorithm families, the signature will validate, allowing for unauthenticated token forgery and identity impersonation. This bypasses existing protections that only check for PEM and SSH key formats.

Affected products

jpadilla PyJWT < 2.13.0

Identifiers

CVE-2026-48526
GHSA-xgmm-8j9v-c9wx
PYSEC-2026-179

Timeline

2026-05-21: disclosed: Initial disclosure on GitHub
2026-05-28: advisory: NVD publication
2026-06-15: patched: Version 2.13.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.