CVE-2026-48525

PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.

• CWE-400

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39Exploit, Mitigation, Vendor Advisory
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39Exploit, Mitigation, Vendor Advisory

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48519Langflow is a tool for building and deploying AI-powered age…9.6
• CVE-2026-4852The Image Source Control Lite – Show Image Credits and Capti…6.4
• CVE-2026-48520Langflow is a tool for building and deploying AI-powered age…6.1
• CVE-2026-48522PyJWT is a JSON Web Token implementation in Python. Prior to…4.2
• CVE-2026-48523PyJWT is a JSON Web Token implementation in Python. From 2.9…5.4
• CVE-2026-48524PyJWT is a JSON Web Token implementation in Python. Prior to…3.7
• CVE-2026-48526PyJWT is a JSON Web Token implementation in Python. Prior to…7.4
• CVE-2026-48527HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-48529GitHub MCP Server is GitHub's official MCP Server. From 0.22…6
• CVE-2026-4853The JetBackup – Backup, Restore & Migrate plugin for WordPre…4.9
• CVE-2026-48530GFI Archiver before 15.13 contains a stored cross-site scrip…5.4
• CVE-2026-48531GFI Archiver before 15.13 contains a stored cross-site scrip…5.4