Listen to this Post
The vulnerability lies in the `PyJWKClient.get_signing_key()` method. The attacker can force the method to fetch the entire JWKS set on every single token validation, without any rate limiting or caching, by just changing a single piece of unverified data in the JWT header. This leads to an explosion of outbound HTTP requests that can easily overwhelm the authorization server or the application itself. The following breakdown details the technical exploitation chain.
How CVE-2026-48524 Works (Technical Breakdown)
- Entry Point: The vulnerability is triggered when a JWT is validated using
PyJWKClient.get_signing_key(). This method is designed to retrieve the correct cryptographic key from a remote JWKS (JSON Web Key Set) endpoint based on the `kid` (Key ID) in the JWT header. - Unverified Input: The `kid` value is taken directly from the token’s header. Crucially, the JWT header is not cryptographically verified at this stage. An attacker can craft a malicious token and set the `kid` field to any arbitrary string they choose.
- Cache Bypass: When `get_signing_key` receives a `kid` value it does not recognize, the code in `jwks_client.py` (lines 172-198) calls
get_signing_keys(refresh=True). This forces a fresh, unconditional HTTP request to the remote JWKS endpoint, completely bypassing any existing Time-To-Live (TTL) cache. - No Rate Limiting: The method lacks any rate-limiting mechanism. It will repeat this behavior for every single token processed that contains an unknown
kid. - DoS Amplification: An attacker can send a flood of tokens, each with a unique, random, or non-existent `kid` (e.g.,
unknown-kid-001,unknown-kid-002). Each of these tokens will force the PyJWKClient to send a new outbound HTTP request to the JWKS endpoint. - Cache Poisoning: The situation is worsened by a secondary bug in the `fetch_data()` method (
jwks_client.pylines 120-122). If any network error (timeout, 5xx error, etc.) occurs during one of these forced fetches, the `finally` block incorrectly sets the local JWKS cache toNone. This clears any valid keys that were previously stored. - Result: An attacker can trigger an endless loop of external requests, leading to a Denial of Service (DoS). The outcome depends on the upstream JWKS endpoint’s behavior, but the local application and its network are always saturated.
DailyCVE Form:
Platform: PyJWT / PyJWKClient
Version: < 2.13.0
Vulnerability: Unbounded JWKS Requests
Severity: Low (CVSS 3.7)
Date: 2026-05-28
Prediction: Already Patched (2.13.0)
What Undercode Say:
Simulate the malicious traffic pattern
'unknown-kid' is an attacker-controlled value in the JWT header.
for i in {1..1000}
do
For each unique 'kid', the PyJWKClient will try to fetch the whole JWKS.
python3 -c "
from jwt import PyJWKClient
import sys
The URL below is the target's JWKS endpoint
client = PyJWKClient('https://your-auth-server.com/.well-known/jwks.json')
This call will force an outbound request for every unique 'kid' value
try:
client.get_signing_key_from_jwt(f'eyJraWQiOiJ1bmtub3duLWtpZC0ke2l9IiwgImFsZyI6IlJTMjU2In0.eyJzdWIiOiIxMjMifQ')
except:
pass
" &
done
The above loop will generate 1000+ outbound HTTP requests from the PyJWKClient.
Exploit:
A single line of code in a loop can cause a DoS.
The 'kid' value in the token header is the attack vector.
malicious_token_header = '{"kid": "nonexistent-key-id-' + str(counter) + '", "alg": "RS256"}'
The PyJWKClient will fetch the entire JWKS endpoint URL for each 'kid'.
client.get_signing_key_from_jwt(encoded_malicious_token)
Protection:
- Upgrade immediately to PyJWT version 2.13.0 or higher, which contains the official fix.
- Implement a local proxy or API gateway with rate limiting to cap the number of outbound requests to the JWKS endpoint from the application.
- Apply a network egress filter to restrict which services can initiate outbound HTTP requests.
Impact:
- Denial of Service (DoS) against the JWKS endpoint: The attacker floods the authentication server with traffic.
- DoS against the local application: The application’s threads are blocked waiting for network I/O, consuming CPU and memory.
- Cascading Cache Failure: A single network error during an attack can clear the entire JWKS cache, breaking legitimate authentication for all users until a successful fetch occurs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
