cve 2026 48524

This tag covers CVE-2026-48524, a vulnerability addressed in PyJWT 2.13.0. The fix resolves a cache-clearing failure but does not prevent PyJWKClient from making new JWKS requests for every JWT with an unknown kid value. For Windows-hosted Python APIs validating bearer tokens against Microsoft Entra ID, Auth0, Okta, or other remote JSON Web Key Set providers, the distinction is critical: upgrade immediately, then implement request controls on the authentication path. Microsoft's Security Update Guide added this CVE on August 8, noting the attack depends on external conditions. The tag focuses on practical remediation for developers and IT teams managing Python authentication in Windows environments.