PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:35836 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:35835 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:35845 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:35837 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26206 advisory.

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34365 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * candlepin: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects     (CVE-2026-27727)
    * yggdrasil-worker-forwarder: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * yggdrasil-worker-forwarder: Go crypto/x509: Certificate validation bypass due to incorrect DNS     constraint application (CVE-2026-33810)
    * yggdrasil-worker-forwarder: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
    * yggdrasil-worker-forwarder: Go: Denial of Service vulnerability in certificate chain building     (CVE-2026-32280)
    * yggdrasil-worker-forwarder: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages     (CVE-2026-32283)
    * yggdrasil-worker-forwarder: Go crypto/x509: Denial of Service via inefficient certificate chain     validation (CVE-2026-32281)
    * python-pillow: Pillow: Denial of Service via decompression bomb in FITS image processing     (CVE-2026-40192)
    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)
    * foreman: foreman: Cross-tenant private SSH key disclosure via taxonomy scoping bypass (CVE-2026-5142)
    * foreman: Foreman: Information disclosure via improper validation of nested request parameters     (CVE-2026-5138)
    * foreman: Foreman: Privilege escalation to administrator-level access via usergroup role assignment     manipulation (CVE-2026-5136)
    * foreman: Foreman: Unauthorized modification of host configurations via broken access control     (CVE-2026-5135)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34160 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-platform-ui: Axios: Denial of Service due to unenforced request and response size limits     (CVE-2026-44488)
    * automation-platform-ui: Axios: Information disclosure due to prototype pollution vulnerability     (CVE-2026-44495)
    * automation-platform-ui: fast-uri: URI authority bypass due to improper delimiter handling     (CVE-2026-6322)
    * automation-platform-ui: Axios: Arbitrary HTTP header injection via prototype pollution (CVE-2026-42035)
    * automation-platform-ui: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization     (CVE-2026-41240)
    * automation-platform-ui: protobufjs: Arbitrary code execution due to unsafe expression generation from     crafted protobuf descriptors (CVE-2026-44293)
    * python3.12-pyjwt: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)
    * automation-controller: Dynaconf: Arbitrary code execution via Server-Side Template Injection     (CVE-2026-33154)
    * python3.12-urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers     (CVE-2026-44431)
    * python3.12-urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory.

    This update for python-PyJWT fixes the following issues

    - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for     SSRF and       token forgery (bsc#1266798).
    - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()`     are called       with a PyJWK key (bsc#1266799).
    - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()`     leads to       unbounded JWKS endpoint requests and DoS (bsc#1266800).
    - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS     allows for DoS       (bsc#1266801).
    - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens     allows for       forged HS256 tokens (bsc#1266802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2627-1 advisory.

    This update for python-PyJWT fixes the following issues

    - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for     SSRF and       token forgery (bsc#1266798).
    - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()`     are called       with a PyJWK key (bsc#1266799).
    - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS     allows for DoS       (bsc#1266801).
    - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens     allows for       forged HS256 tokens (bsc#1266802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22170-1 advisory.

    This update for python-PyJWT fixes the following issues

    - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for     SSRF and       token forgery (bsc#1266798).
    - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()`     are called       with a PyJWK key (bsc#1266799).
    - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()`     leads to       unbounded JWKS endpoint requests and DoS (bsc#1266800).
    - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS     allows for DoS       (bsc#1266801).
    - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens     allows for       forged HS256 tokens (bsc#1266802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26206 advisory.

    - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526       Resolves: RHEL-182313
    - bundled pyasn1: fix CVE-2026-30922       Resolves: RHEL-157202
    - bundled cryptography: replace with dependency to fix CVE-2026-26007

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1842 advisory.

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON     Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of     JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC     algorithm. This vulnerability is fixed in 2.13.0. (CVE-2026-48526)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26206 advisory.

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON
    Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of
    JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC
    algorithm. This vulnerability is fixed in 2.13.0. (CVE-2026-48526)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26206 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:25902 advisory.

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:25902 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON     Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of     JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC     algorithm. This vulnerability is fixed in 2.13.0. (CVE-2026-48526)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325271	RHEL 9 : fence-agents (RHSA-2026:35836)	Nessus	Red Hat Local Security Checks	high
325208	RHEL 9 : fence-agents (RHSA-2026:35835)	Nessus	Red Hat Local Security Checks	high
325166	RHEL 10 : fence-agents (RHSA-2026:35845)	Nessus	Red Hat Local Security Checks	high
325165	RHEL 9 : fence-agents (RHSA-2026:35837)	Nessus	Red Hat Local Security Checks	high
324827	AlmaLinux 9 : fence-agents (ALSA-2026:26206)	Nessus	Alma Linux Local Security Checks	high
324610	RHEL 9 : Satellite 6.19.2 Async Update (Important) (RHSA-2026:34365)	Nessus	Red Hat Local Security Checks	high
324569	RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:34160)	Nessus	Red Hat Local Security Checks	high
323065	SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)	Nessus	SuSE Local Security Checks	high
323028	SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2627-1)	Nessus	SuSE Local Security Checks	high
322913	SUSE SLES16 Security Update : python-PyJWT (SUSE-SU-2026:22170-1)	Nessus	SuSE Local Security Checks	high
322736	Oracle Linux 9 : fence-agents (ELSA-2026-26206)	Nessus	Oracle Linux Local Security Checks	high
322092	Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-1842)	Nessus	Amazon Linux Local Security Checks	high
321391	RockyLinux 9 : fence-agents (RLSA-2026:26206)	Nessus	Rocky Linux Local Security Checks	high
443250	SCA: security update for pyjwt (GHSA-xgmm-8j9v-c9wx)	Tenable Cloud Security	SCA Checks	high
443250	SCA: security update for pyjwt (GHSA-xgmm-8j9v-c9wx)	Tenable Self-Hosted Container Security	SCA Checks	high
321231	RHEL 9 : fence-agents (RHSA-2026:26206)	Nessus	Red Hat Local Security Checks	high
321191	RockyLinux 10 : fence-agents (RLSA-2026:25902)	Nessus	Rocky Linux Local Security Checks	high
321094	RHEL 10 : fence-agents (RHSA-2026:25902)	Nessus	Red Hat Local Security Checks	high
317775	Linux Distros Unpatched Vulnerability : CVE-2026-48526	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48526

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high