[pkg-vuln] CVE-2026-48525 in pyjwt@2.12.1 #536

New Issue

kert · 2026-07-10T01:31:28Z

kert commented

2026-07-10 01:31:28 +00:00

Severity: MEDIUM
Package: pyjwt @ 2.12.1
Fixed in: 2.13.0

PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-48525

**Severity:** MEDIUM **Package:** `pyjwt` @ `2.12.1` **Fixed in:** `2.13.0` PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-48525

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-10 01:31:28 +00:00

kert added the ci quality labels 2026-07-10 01:31:28 +00:00

kert commented

2026-07-10 17:19:02 +00:00

Not exploitable here. CVE-2026-48525 involves RFC 7797 ("b64": false) detached-payload verification, which is never used. The only JWT usage is src/api/deps.py (jwt.decode(..., secret, algorithms=["HS256"]) with a static shared secret) and src/api/routes/auth.py (jwt.encode(..., algorithm="HS256")). No PyJWK, PyJWKClient, JWKS endpoint, or RFC 7797 detached payloads anywhere in the codebase (grep clean).

Bumped anyway (defense in depth): pyjwt 2.12.1 → 2.13.0 in 65c31cf88f (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

**Not exploitable here.** CVE-2026-48525 involves RFC 7797 (`"b64": false`) detached-payload verification, which is never used. The only JWT usage is `src/api/deps.py` (`jwt.decode(..., secret, algorithms=["HS256"])` with a static shared secret) and `src/api/routes/auth.py` (`jwt.encode(..., algorithm="HS256")`). No `PyJWK`, `PyJWKClient`, JWKS endpoint, or RFC 7797 detached payloads anywhere in the codebase (grep clean). **Bumped anyway** (defense in depth): `pyjwt` 2.12.1 → 2.13.0 in https://git.fhirworx.io/homelab/stack/commit/65c31cf88fd8de552a006859159790de468403fb (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

kert closed this issue

2026-07-10 17:19:02 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#536