7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-101917

CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-101917

CVE-2026-101917:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyjwt	pip	<= 2.13.0	2.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-101917, describes an incomplete fix for a previous DoS vulnerability (CVE-2026-48524) in PyJWT's PyJWKClient. The core issue is that the get_signing_key method, when presented with an unknown kid from an unverified token header, would unconditionally trigger a full refresh of the JWKS (JSON Web Key Set) from the configured endpoint. This refresh involved an outbound HTTP request and subsequent JSON parsing, consuming server resources. The patch ba4853a75fb9676362da17f67d0f64bd18afd4e1 introduces a cooldown_duration and a locking mechanism (_client_lock) within the get_signing_key method. Specifically, the lines removed from the get_signing_key method demonstrate the prior behavior of immediately calling self.get_signing_keys(refresh=True) without any checks for rate limiting or negative caching. The added code now checks if the client is 'cooling down' before allowing another forced refresh, thereby mitigating the amplification attack. Therefore, PyJWKClient.get_signing_key is the precise function that was vulnerable as it directly processed the attacker-controlled input (kid) and initiated the resource-intensive operation without proper safeguards.

Vulnerable functions

PyJWKClient.get_signing_key

jwt/jwks_client.py

In the vulnerable version (<= 2.13.0), the `get_signing_key` method in `PyJWKClient` would unconditionally call `get_signing_keys(refresh=True)` if an unknown `kid` (key ID) was encountered. This `refresh=True` flag bypassed the JWK set cache and forced a new network fetch (`fetch_data`) from the JWKS endpoint. Since the `kid` is read from an unverified token header, an attacker could repeatedly send tokens with arbitrary, unknown `kid` values, causing the server to perform an unbounded number of outbound HTTP requests and JSON parsing operations, leading to a Denial of Service (DoS) due to resource exhaustion. The removed lines show the lack of a cooldown or negative cache before re-fetching, which was the core of the vulnerability. The patch introduces a cooldown mechanism to prevent this unbounded fetching, directly addressing the flaw in this function's logic for handling unknown `kid` values after an initial lookup failure. This function is directly responsible for processing the `kid` and initiating the vulnerable behavior without proper rate limiting or caching for unknown keys. The `_client_lock` and `cooling_down` logic were added to this function to mitigate the issue, indicating it was the point of vulnerability. The `get_signing_key_from_jwt` function also contributes by calling `get_signing_key` with an unverified token header, but the core vulnerability lies in `get_signing_key`'s handling of the `kid` itself, not in how it receives it. Therefore, `PyJWKClient.get_signing_key` is the most precise vulnerable function for runtime profiling during exploitation of the DoS amplification. The `fetch_data` function is called by the vulnerable path, but it is not inherently vulnerable; the vulnerability is in the logic that *decides* to call `fetch_data` repeatedly without control, which resides in `get_signing_key`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

CVE-2026-101917:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Basic Information

Basic Information

7.5

7.5

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

CVE-2026-101917:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-101917: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Basic Information

Basic Information

7.5

7.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI