7.4Alta

CVE-2026-48526PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

jpadilla pyjwt; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible… Publicada: 2026-05-28 18:09 (hace 5 meses)

Descripción

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Debilidad (CWE): CWE-287 CWE-347

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
ai inference server	3.3	—
ansible automation platform	2.5	—
ansible automation platform	2.6	—
ansible automation platform	2.7	—
jpadilla	pyjwt	< 2.13.0
migration toolkit applications	8.2	—
openshift ai	2.25	—
openshift ai	3.3	—
openshift ai	3.4	—
pyjwt project	pyjwt	< 2.13.0
quay	3.10	—
quay	3.12	—
quay	3.15	—
quay	3.16	—
quay	3.18	—
quay	3.9	—
Red Hat	OpenShift Lightspeed	all versions
Red Hat	Red Hat AI Inference Server	all versions
Red Hat	Red Hat AI Inference Server 3.3	all versions
Red Hat	Red Hat Ansible Automation Platform 2	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.7	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
Red Hat	Red Hat Migration Toolkit for Applications 8.2	all versions
Red Hat	Red Hat OpenShift AI 2.25	all versions
Red Hat	Red Hat OpenShift AI 3.3	all versions
Red Hat	Red Hat OpenShift AI 3.4	all versions
Red Hat	Red Hat Quay 3.10	all versions
Red Hat	Red Hat Quay 3.12	all versions
Red Hat	Red Hat Quay 3.15	all versions
Red Hat	Red Hat Quay 3.16	all versions
Red Hat	Red Hat Quay 3.18	all versions
Red Hat	Red Hat Quay 3.9	all versions
Red Hat	Red Hat Satellite 6.16 for RHEL 8	all versions
Red Hat	Red Hat Satellite 6.16 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.17 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.18	all versions
Red Hat	Red Hat Satellite 6.18 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.19 for RHEL 9	all versions
Red Hat	Red Hat Trusted Artifact Signer 1.3	all versions
Red Hat	Red Hat Trusted Artifact Signer 1.4	all versions
rhui	4	—
satellite	6.16	—
satellite	6.17	—
satellite	6.18	—
satellite	6.19	—
satellite capsule	6.16	—
satellite capsule	6.17	—
satellite capsule	6.18	—
satellite capsule	6.19	—
trusted artifact signer	1.3	—
trusted artifact signer	1.4	—

Referencias y parches

Coincidencias CPE (NVD) (1)

cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* < 2.13.0

Puntuación CVSS

7.4Alta

Fuente: GitHub_M · CVSS 3.1

Vector de ataque: Red
Complejidad: Alta
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Todas las puntuaciones (4)

cna	CVSS 3.1	7.4Alta
redhat-SADP	CVSS 3.1	7.4Alta
security-advisories@github.com	CVSS 3.1	7.4Alta
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.4Alta

EPSS (probabilidad de explotación en 30 días)

0.43%

superior al 37 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: poc
Automatizable: no
Impacto técnico: total

Cronología

ID reservado2026-05-21
Publicada2026-05-28 18:09
Llegó a IP-DB2026-10-24 23:44
Última actualización2026-10-26 16:10

Asignada por (CNA): GitHub_M
Estado en NVD: Modified

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera