CVE-2026-101917

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0

Description The get signing key from jwt function is affected by a flaw where unknown kid (Key ID) values trigger forced refreshes of the JSON Web Key Set (JWKS) without a negative cache or minimum refresh interval. This happens when unauthenticated tokens use the same unknown kid or various kid values not present in the cached JWKS, causing the PyJWKClient to refresh the JWKS on every cache miss. This behavior allows attacker traffic to amplify outbound requests to the configured JWKS endpoint.

Recommendations Update to version 2.14.0.