Към съдържанието
Търсене

CVE-2026-48526: jpadilla pyjwt, заобикаляне на вход и права

7.4

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

Засегнати продукти

  • jpadilla pyjwt: < 2.13.0
  • Red Hat: още 39 продукта, добавени от Red Hat

    Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat Satellite 6.19 for RHEL 9, Red Hat AI Inference Server 3.3, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.4, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.18, Red Hat Quay 3.9, Red Hat Satellite 6.18, Red Hat Trusted Artifact Signer 1.3, Red Hat Trusted Artifact Signer 1.4, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat Update Infrastructure 4 for Cloud Providers

Вид слабост

История

  • 28 май 2026 Публикувано

Други уязвимости в jpadilla pyjwt

Първоизточници

CVE-2026-48526: jpadilla pyjwt, заобикаляне на вход и права | freedomonline.bg