pyjwt

CVE-2026-32597 is a PyJWT token-validation flaw, not a Windows operating system vulnerability, and the practical fix is to update the Python dependency in applications and containers that verify JSON Web Tokens. PyJWT versions before 2.12.0 accepted JWS tokens declaring unknown critical header...

PyJWT 2.13.0 fixes the cache-clearing failure behind CVE-2026-48524, but it does not stop PyJWKClient from making a new JWKS request for every JWT carrying an unknown kid value. For Windows-hosted Python APIs that validate bearer tokens against Microsoft Entra ID, Auth0, Okta, or another remote...