CVE-2026-48526: PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Synopsis

This is an algorithm-confusion vulnerability in PyJWT, a widely used Python JSON Web Token library. A remote attacker with no authentication can exploit the flaw by taking a server's public key and using it as the HMAC secret to forge HS256-signed tokens, bypassing signature verification when the server accepts both asymmetric (RS256, ES256) and HMAC (HS256) algorithm families. Successful exploitation lets an attacker forge arbitrary JWT claims, enabling identity impersonation, authorization bypass, and access to protected data or actions. Note: the description references a fix in 2.13.0, but no fix version has been formally published to the advisory record yet; HarborGuard is tracking the advisory for confirmed patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JWT-accepting service over the network; the AV:N vector means no local or physical access is required.

• AuthenticationNot required

  No credentials are needed; the attacker only requires knowledge of the target server's public key, which is often publicly available.

• Victim interactionNot required

  No user action is needed; the attacker submits a crafted token directly to the service endpoint.

• Attack complexityDetail

  AC:H indicates the exploit is not trivially condition-free: the attacker must obtain the server's public key and the server must be configured to accept both asymmetric and HMAC algorithm families simultaneously.

Blast Radius

• Forged JWT claims allow the attacker to impersonate any user identity, including privileged accounts, without knowing any private key or password.
• Authorization checks that rely on JWT-encoded roles or scopes are bypassed, granting access to protected API endpoints and data.
• Confidential resources tied to authenticated sessions (user records, stored tokens, application data) become readable by the attacker.
• Application data or state reachable through authenticated write operations can be modified using the forged token.