PyJWT’s client logic amplifies outbound requests to the JWKS endpoint when a token includes an unknown or changing kid value. Each cache miss triggers a refresh fetch, so an attacker can submit many unauthenticated tokens with unfamiliar kid values to artificially inflate the number of JWKS requests. The result is increased bandwidth usage and potential exhaustion of the JWKS server or the client application’s resources, which may render the service unavailable. Based on the description, it is inferred that an attacker can force the client to fetch the JWKS by supplying arbitrary kid values. The vulnerability is rooted in CWE‑408 and CWE‑770, reflecting improper authorization handling and over‑creation of resources.

The affected library is PyJWT from the jpadilla:pyjwt project. All releases preceding version 2.14.0 are vulnerable; version 2.14.0 and later contain the fix that prevents repeated JWKS fetches from unknown kid values.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is lower than 1%. No listing in the CISA KEV catalog suggests limited known exploitation. However, the vulnerability can be leveraged by an attacker who can send repeated authentication requests to a vulnerable service. By repeatedly presenting tokens with unknown kid identifiers, the attacker can cause the service to perform frequent outbound JWKS queries, amplifying network traffic and potentially exhausting server resources. The risk is mitigated by the public fix, but until patched, the attack remains feasible with minimal prerequisites. Based on the description, the likely attack vector is the submission of unauthenticated tokens with unknown kid values, and the likelihood of exploitation is inferred to be low due to the requirement for repeated requests, though the EPSS indicates a very low probability of exploitation.