VDB
RHSA-2026:50904
RHSA-2026:50904
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhtas/model-transparency-rhel9@sha256:997111359afd34ae4f5e27ac9e883182e0438f7ddcfc4f829d05b79ac5c468ab_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/model-transparency-rhel9@sha256:e0f2fe8d94dbe653218403f633691887fdbd7b651f15c74a3ec909bae2c309e6_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
Timeline
- Aug 5, 2026 CVE Published
- Aug 18, 2026 CVE Updated
- Aug 18, 2026 Distribution Patch
- Aug 18, 2026 Distribution Patch
- Aug 18, 2026 Security Advisory
- Aug 18, 2026 Security Advisory
- Aug 18, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50904 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index advisory
- https://access.redhat.com/security/cve/CVE-2026-48526 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50904.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2482734 issue
- https://www.cve.org/CVERecord?id=CVE-2026-48526 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48526 advisory
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2500041 issue
- https://www.cve.org/CVERecord?id=CVE-2026-59886 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59886 advisory
- https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886 advisory
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 advisory
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r advisory