🟠 High | Source: Microsoft Security Response Center
CVE-2026-48524 is a denial-of-service vulnerability in PyJWT’s JWKClient, which fetches public keys from a remote JWKS endpoint to verify JSON Web Tokens. An attacker can craft JWT tokens containing arbitrary ‘kid’ (key ID) values, causing the client to make unbounded outbound HTTP requests to the JWKS endpoint and potentially exhausting resources or triggering rate-limiting. Any Azure-hosted application using PyJWT’s JWKClient for token validation may be vulnerable to service disruption.
Security Architect’s Take: Audit any services using PyJWT’s PyJWKClient and upgrade to the patched version immediately; in the interim, implement caching with a strict TTL and rate-limit or allowlist JWKS endpoint lookups to prevent unbounded outbound requests triggered by attacker-controlled JWT inputs.
Original advisory: CVE-2026-48524 PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)