The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces     a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting.
    Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The     vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with     sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting,     transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
    (CVE-2026-48524)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-48524

low Nessus Plugin ID 317822

Version 1.10