CVE-2026-48526

Microsoft · Published August 7, 2026

7.4

CVSS v3.1

HIGH

Patch availableGet patch

Description

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed. PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Affected Products

azl3 python-jwt 2.8.0-2 on Azure Linux 3.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N