PyJWT implements JSON Web Token standards; PyJWKClient retrieves signing keys from a JWKS endpoint. Prior to version 2.14.0, a trusted JWKS endpoint that returned an attacker‑controlled redirect was not revalidated against the original trust boundary. The client followed the redirect and treated the redirected payload as key material, allowing the attacker to supply a forged key or cause disclosure of forwarded credentials. This flaw enables information disclosure or substitution of verification keys.

All installations of the jpadilla:pyjwt library before version 2.14.0 are affected. The vulnerability occurs whenever an application configures a PyJWKClient instance to any JWKS endpoint, regardless of operating system or deployment environment. Every project depending on that version of the library is potentially exposed.

The CVSS score is 7.4, classifying the issue as high severity. EPSS score is < 1% (0.00157), and it is not listed in the CISA KEV catalog. Exploitation is possible when an attacker can influence or hijack a JWKS endpoint to issue a redirect. Because the redirect is automatically followed, a remote adversary can supply malicious key material or obtain credentials that would otherwise be hidden, compromising token verification integrity or revealing sensitive information. The risk is substantial for applications that trust external JWKS providers or rely on unvalidated network paths.