Skip to content
Heist/ feed
UnratedFix available

UBUNTU-CVE-2026-48522

Type: advisorySource: OSV1 source record

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.

Announced Source revision 1
Original source ↗

UBUNTU-CVE-2026-48522

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-48522

pyjwt

Source reference: /affected/0/package/name

Affected versions
1.7.1-2ubuntu2

Source reference: /affected/0/versions

2.1.0-1

Source reference: /affected/0/versions

2.3.0-1

Source reference: /affected/0/versions

2.3.0-1ubuntu0.1

Source reference: /affected/0/versions

2.3.0-1ubuntu0.2

Source reference: /affected/0/versions

2.3.0-1ubuntu0.3

Source reference: /affected/0/versions

Fixed versions
2.3.0-1ubuntu0.4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

pyjwt

Source reference: /affected/1/package/name

Affected versions
2.7.0-1

Source reference: /affected/1/versions

2.7.0-1ubuntu0.1

Source reference: /affected/1/versions

Fixed versions
2.7.0-1ubuntu0.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

pyjwt

Source reference: /affected/2/package/name

Affected versions
2.10.1-2

Source reference: /affected/2/versions

2.10.1-2ubuntu0.1

Source reference: /affected/2/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

pyjwt

Source reference: /affected/3/package/name

Affected versions
2.10.1-2

Source reference: /affected/3/versions

2.10.1-3

Source reference: /affected/3/versions

2.10.1-3build1

Source reference: /affected/3/versions

2.10.1-4

Source reference: /affected/3/versions

2.10.1-4ubuntu1

Source reference: /affected/3/versions

Fixed versions
2.10.1-4ubuntu1.1

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.3.0-1ubuntu0.4"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=jammy",
      "ecosystem": "Ubuntu:22.04:LTS"
    },
    "versions": [
      "1.7.1-2ubuntu2",
      "2.1.0-1",
      "2.3.0-1",
      "2.3.0-1ubuntu0.1",
      "2.3.0-1ubuntu0.2",
      "2.3.0-1ubuntu0.3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48522.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.3.0-1ubuntu0.4"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.7.0-1ubuntu0.2"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "2.7.0-1",
      "2.7.0-1ubuntu0.1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48522.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.7.0-1ubuntu0.2"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=questing",
      "ecosystem": "Ubuntu:25.10"
    },
    "versions": [
      "2.10.1-2",
      "2.10.1-2ubuntu0.1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48522.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.10.1-2ubuntu0.1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.10.1-4ubuntu1.1"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute",
      "ecosystem": "Ubuntu:26.04:LTS"
    },
    "versions": [
      "2.10.1-2",
      "2.10.1-3",
      "2.10.1-3build1",
      "2.10.1-4",
      "2.10.1-4ubuntu1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48522.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-jwt",
          "binary_version": "2.10.1-4ubuntu1.1"
        }
      ],
      "availability": "No subscription required"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#22394 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement