Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-102267, describes how PyJWKClient in PyJWT versions up to 2.13.0 followed HTTP redirects without validating the destination. This could lead to information disclosure (request headers) or JWKS trust poisoning. The provided commit 0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56 directly addresses this issue.
Upon analyzing the diff in jwt/jwks_client.py, it's clear that the fetch_data method was the point of vulnerability. The original implementation used urllib.request.urlopen, which inherently follows redirects. The patch introduces a new class, _NoRedirectHandler, which overrides the redirect_request method to prevent any redirects. This handler is then incorporated into a urllib.request.build_opener call, replacing the direct urlopen call within fetch_data. Therefore, the PyJWKClient.fetch_data function in its state prior to this commit is the vulnerable function, as it was responsible for making the network request that could be redirected.
PyJWKClient.fetch_datajwt/jwks_client.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PyJWT | pip | <= 2.13.0 | 2.14.0 |