CyberRota Analysis
AI-GeneratedThe PyJWT library, specifically the PyJWKClient component, is vulnerable due to inadequate validation of redirect destinations against the JWKS trust boundary, allowing attackers to influence redirects from trusted endpoints. This flaw can lead to the disclosure of forwarded credentials or the substitution of verification keys, posing a significant security risk. Organizations using versions prior to 2.14.0 should prioritize upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)