CVE intelligence

CVE-2026-48524

Vulnerability intelligence

Published May 28, 2026Sources checked Nov 11, 2026

3.7LOWCVSS out of 10

What this means

Review the available evidence

CVE-2026-48524 and is rated Low severity with a CVSS score of 3.7. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 7, 2026

Release Notes

Vendor-listed releases

2.15.1-1

Microsoft Security Response Center guidance

Vendor revision: Aug 8, 2026

CBL-Mariner Releases

Vendor-listed releases

2.13.0-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-48524?

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting.

Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control.

This vulnerability is fixed in 2.13.0.

Source: NVD