UnratedFix available

UBUNTU-CVE-2026-48526

Type: advisorySource: OSV1 source record

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Announced 28 May 2026Source revision 1

Original source ↗

UBUNTU-CVE-2026-48526

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-48526

pyjwt

Source reference: /affected/0/package/name

Affected versions: 1.0.0-0ubuntu1
Source reference: /affected/0/versions
1.3.0-1
Source reference: /affected/0/versions
1.3.0-1ubuntu0.1
Source reference: /affected/0/versions
1.3.0-1ubuntu0.1+esm1
Source reference: /affected/0/versions
Fixed versions: 1.3.0-1ubuntu0.1+esm2
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

pyjwt

Source reference: /affected/1/package/name

Affected versions: 1.4.2-1.1
Source reference: /affected/1/versions
1.5.3+ds1-1
Source reference: /affected/1/versions
1.5.3+ds1-1ubuntu0.1
Source reference: /affected/1/versions
1.5.3+ds1-1ubuntu0.1+esm1
Source reference: /affected/1/versions
Fixed versions: 1.5.3+ds1-1ubuntu0.1+esm2
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

pyjwt

Source reference: /affected/2/package/name

Affected versions: 1.7.0-2
Source reference: /affected/2/versions
1.7.1-1
Source reference: /affected/2/versions
1.7.1-2ubuntu1
Source reference: /affected/2/versions
1.7.1-2ubuntu2
Source reference: /affected/2/versions
1.7.1-2ubuntu2.1
Source reference: /affected/2/versions
1.7.1-2ubuntu2.1+esm1
Source reference: /affected/2/versions
Fixed versions: 1.7.1-2ubuntu2.1+esm2
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

pyjwt

Source reference: /affected/3/package/name

Affected versions: 1.7.1-2ubuntu2
Source reference: /affected/3/versions
2.1.0-1
Source reference: /affected/3/versions
2.3.0-1
Source reference: /affected/3/versions
2.3.0-1ubuntu0.1
Source reference: /affected/3/versions
2.3.0-1ubuntu0.2
Source reference: /affected/3/versions
2.3.0-1ubuntu0.3
Source reference: /affected/3/versions
Fixed versions: 2.3.0-1ubuntu0.4
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

pyjwt

Source reference: /affected/4/package/name

Affected versions: 2.7.0-1
Source reference: /affected/4/versions
2.7.0-1ubuntu0.1
Source reference: /affected/4/versions
Fixed versions: 2.7.0-1ubuntu0.2
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

pyjwt

Source reference: /affected/5/package/name

Affected versions: 2.10.1-2
Source reference: /affected/5/versions
2.10.1-2ubuntu0.1
Source reference: /affected/5/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

pyjwt

Source reference: /affected/6/package/name

Affected versions: 2.10.1-2
Source reference: /affected/6/versions
2.10.1-3
Source reference: /affected/6/versions
2.10.1-3build1
Source reference: /affected/6/versions
2.10.1-4
Source reference: /affected/6/versions
2.10.1-4ubuntu1
Source reference: /affected/6/versions
Fixed versions: 2.10.1-4ubuntu1.1
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.3.0-1ubuntu0.1+esm2"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "1.0.0-0ubuntu1",
      "1.3.0-1",
      "1.3.0-1ubuntu0.1",
      "1.3.0-1ubuntu0.1+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-jwt",
          "binary_version": "1.3.0-1ubuntu0.1+esm2"
        },
        {
          "binary_name": "python3-jwt",
          "binary_version": "1.3.0-1ubuntu0.1+esm2"
        }
      ],
      "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.5.3+ds1-1ubuntu0.1+esm2"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "1.4.2-1.1",
      "1.5.3+ds1-1",
      "1.5.3+ds1-1ubuntu0.1",
      "1.5.3+ds1-1ubuntu0.1+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-jwt",
          "binary_version": "1.5.3+ds1-1ubuntu0.1+esm2"
        },
        {
          "binary_name": "python3-jwt",
          "binary_version": "1.5.3+ds1-1ubuntu0.1+esm2"
        }
      ],
      "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.7.1-2ubuntu2.1+esm2"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "1.7.0-2",
      "1.7.1-1",
      "1.7.1-2ubuntu1",
      "1.7.1-2ubuntu2",
      "1.7.1-2ubuntu2.1",
      "1.7.1-2ubuntu2.1+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "1.7.1-2ubuntu2.1+esm2"
        }
      ],
      "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.0-1ubuntu0.4"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=jammy",
      "ecosystem": "Ubuntu:22.04:LTS"
    },
    "versions": [
      "1.7.1-2ubuntu2",
      "2.1.0-1",
      "2.3.0-1",
      "2.3.0-1ubuntu0.1",
      "2.3.0-1ubuntu0.2",
      "2.3.0-1ubuntu0.3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.3.0-1ubuntu0.4"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.7.0-1ubuntu0.2"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "2.7.0-1",
      "2.7.0-1ubuntu0.1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.7.0-1ubuntu0.2"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=questing",
      "ecosystem": "Ubuntu:25.10"
    },
    "versions": [
      "2.10.1-2",
      "2.10.1-2ubuntu0.1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.10.1-2ubuntu0.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.10.1-4ubuntu1.1"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute",
      "ecosystem": "Ubuntu:26.04:LTS"
    },
    "versions": [
      "2.10.1-2",
      "2.10.1-3",
      "2.10.1-3build1",
      "2.10.1-4",
      "2.10.1-4ubuntu1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48526.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.10.1-4ubuntu1.1"
        }
      ],
      "availability": "No subscription required"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #22393 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:00:56 GMT
Publisher date: Thu, 28 May 2026 16:16:00 GMT

Read the original announcement