Pypi · Pyjwt · CVE-2026-48523
**Name of the Vulnerable Software and Affected Versions**
PyJWT versions 2.9.0 through 2.12.1
**Description**
A verifier-side algorithm allow-list bypass occurs when `jwt.decode()` or `jwt.decode complete()` are called with a PyJWK key. While the token header `alg` is checked against the provided algorithms allow-list, signature verification is performed using the algorithm bound to the PyJWK object rather than the header algorithm. This allows an attacker controlling a registered JWK/JWKS private key to sign a token with a disallowed algorithm and advertise an allowed algorithm in the JWT header to gain acceptance. This issue affects the `PyJWKClient.get signing key from jwt(...)` flow.
**Recommendations**
Update to version 2.13.0.