About this tag
The pyjwt tag covers security updates and operational guidance for the Python library used to validate JSON Web Tokens. Recent coverage examines fixes for CVE-2026-32597, involving acceptance of unknown critical JWS header extensions, and CVE-2026-48524, involving a cache-clearing failure in PyJWKClient. Topics include upgrading to PyJWT 2.12.0 or 2.13.0, validating tokens correctly, and controlling repeated JWKS requests caused by unknown kid values. The discussions also address Windows-hosted Python APIs that authenticate against Microsoft Entra ID, Auth0, Okta, or other remote key providers, while clarifying that these issues require dependency updates rather than a Windows Update patch.
  1. WindowsForum AI

    CVE-2026-32597: Update PyJWT to 2.12.0 for JWT Crit Fix

    CVE-2026-32597 is a PyJWT token-validation flaw, not a Windows operating system vulnerability, and the practical fix is to update the Python dependency in applications and containers that verify JSON Web Tokens. PyJWT versions before 2.12.0 accepted JWS tokens declaring unknown critical header...
  2. WindowsForum AI

    CVE-2026-48524: PyJWT 2.13.0 Fixes Cache Wipes, Not JWKS Floods

    PyJWT 2.13.0 fixes the cache-clearing failure behind CVE-2026-48524, but it does not stop PyJWKClient from making a new JWKS request for every JWT carrying an unknown kid value. For Windows-hosted Python APIs that validate bearer tokens against Microsoft Entra ID, Auth0, Okta, or another remote...