Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 PyJWT, JWT Algorithm Confusion BOM Bypass, #CVE-2026-48526 (High) -DC-Sep2026-2641 https://dailycve.com/pyjwt-jwt-algorithm-confusion-bom-bypass-cve-2026-48526-high-dc-sep2026-2641/
Post summary
The tweet announces a new high-severity vulnerability in PyJWT (CVE-2026-48526) involving JWT algorithm confusion and BOM bypass, pointing readers to a DailyCVE advisory without mentioning exploits, PoCs, or patches.
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-48526](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx) PyJWT... https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx #ZeroDay #PatchManagement #Vulnerability
Post summary
The post announces the discovery of CVE‑2026‑48526 for PyJWT and provides a link to a GitHub security advisory, without detailed technical or exploit information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pyjwt_project | pyjwt | - | - | - |