CVE-2026-102267 is a high severity (CVSS 7.4) flaw in PyJWT's PyJWKClient. Before 2.14.0 it followed redirects from a trusted JWKS endpoint without checking the destination, which could leak request headers or let someone substitute keys. Upgrade to PyJWT 2.14.0, which turns off automatic redirects for JWKS fetches.
What's affected
The GitHub advisory lists PyJWT 2.13.0 and earlier as affected, with 2.14.0 as the first fixed release. The maintainers' note says that 2.14.0 was released on 2026-09-11 and contains the fix.
You are in the described condition when you use PyJWKClient, you pass your own request headers, and an attacker can influence what the configured JWKS endpoint returns. A token's kid value alone does not trigger the problem, according to the advisory.
How to check if you're exposed
Check the version and find your JWKS clients:
pip show pyjwt
grep -rn "PyJWKClient" --include=*.py .
For each use, note the JWKS URL, whether you send headers such as an API key or an authorization value, and who can change what that endpoint returns, for example through an open redirect, a compromised host or a misconfigured proxy.
What to do now
- Upgrade to PyJWT 2.14.0 or later.
- Point
PyJWKClientat the final JWKS URL, not at a URL that redirects. - Avoid sending sensitive headers to the JWKS endpoint unless it needs them.
- Review the hosts that serve your JWKS, and who can edit their responses or redirects.
- Rebuild images and confirm the new version in each running service.
Why it matters
The fix, per the advisory, is that PyJWKClient now disables automatic redirects for JWKS fetches, and a redirect is refused without contacting the destination. The risks are listed in the record as CWE-200 (exposure of sensitive information), CWE-345 (insufficient verification of data authenticity) and CWE-918 (server-side request forgery).
Key sets are a trust boundary. If a client follows a redirect, that trust moves to whoever runs the destination, and the response is then used as the authoritative set of verification keys. That is how a small HTTP default turns into forged tokens in some setups.
The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Is this the same bug as CVE-2026-102266?
No. That one is about empty HMAC keys in a JWK. This one is about redirects when fetching a JWKS. Both are fixed in PyJWT 2.14.0.
Sources
Last reviewed: 19 October 2026.
