CVE-2026-48522

Microsoft · Published July 24, 2026

4.2

CVSS v3.1

MEDIUM

Patch availableGet patch

Description

PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes. PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

Affected Products

azl3 python-jwt 2.8.0-2 on Azure Linux 3.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N