There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side
    algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The
    token header alg is checked against the caller-supplied algorithms allow-list, but signature verification
    is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who
    controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed
    algorithm in the JWT header, and still be accepted. The issue affects the documented
    PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0. (CVE-2026-48523)

远程 Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS 主机上安装的多个程序包受到公告 USN-8823-1 中提及的多个漏洞影响。

    发现 PyJWT 在使用 PyJWKClient 时未能正确处理某些 URI。远程攻击者可能利用此问题执行服务器端请求伪造（SSRF）或暴露敏感本地文件。此问题仅影响 Ubuntu 22.04 LTS、Ubuntu 24.04 LTS 和 Ubuntu 26.04 LTS。(CVE-2026-48522)

    发现 PyJWT 在通过 PyJWK 密钥解码标记时未能正确验证加密签名。远程攻击者可能利用此问题绕过签名验证并伪造有效的 JSON Web Tokens。此问题仅影响 Ubuntu 26.04 LTS。(CVE-2026-48523)

    发现 PyJWT 在 PyJWKClient 中错误处理了未知的密钥标识符。远程攻击者可能利用此问题导致 PyJWT 进行过多的网络请求，从而引发拒绝服务。此问题仅影响 Ubuntu 24.04 LTS 和 Ubuntu 26.04 LTS。(CVE-2026-48524)

    发现 PyJWT 在执行分离的 JWS 标记验证期间，未能正确处理负载解码。
    远程攻击者可能利用此问题导致 PyJWT 消耗过多资源，从而导致拒绝服务。此问题仅影响 Ubuntu 24.04 LTS 和 Ubuntu 26.04 LTS。(CVE-2026-48525)

    发现 PyJWT 在同时启用了 HMAC 和非对称算法的标记中解码时未正确验证 JSON Web 密钥。远程攻击者可能利用此问题伪造有效令牌，从而绕过身份验证。(CVE-2026-48526)

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - PyJWT 是 Python 中的 JSON Web Token 实现。从 2.9.0 到 2.12.1，使用 PyJWK 密钥调用 jwt.decode（） 或 jwt.decode_complete（） 时，存在验证器端算法允许列表绕过。会根据调用方提供的算法允许列表检查令牌标头 alg，但签名验证是使用绑定到 PyJWK 对象的算法执行，而非标头算法。控制已注册 JWK/JWKS 私钥的攻击者可以使用禁用的算法签名、在 JWT 标头中公告允许的算法，并且仍然可被接受。此问题会影响记录的 PyJWKClient.get_signing_key_from_jwt（...） 流。此漏洞已在 2.13.0 中修复。(CVE-2026-48523)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - PyJWTは、PythonのJSON Webトークン実装です。2.9.0から2.12.1まででは、jwt.decode()またはjwt.decode_complete()がPyJWKキーで呼び出されるとき、検証機能側のアルゴリズム許可リストバイパスがあります。トークンヘッダーアルゴリズムは呼び出し元指定のアルゴリズム許可リストに対してチェックされますが、署名検証はヘッダーアルゴリズムではなくPyJWKオブジェクトにバインドされたアルゴリズムで実行されます。登録されたJWK/JWKS秘密鍵を制御する攻撃者は、許可されていないアルゴリズムで署名し、許可されたアルゴリズムをJWTヘッダーでアドバタイズしても、受け入れられる可能性があります。この問題は、文書化されている PyJWKClient.get_signing_key_from_jwt(...) フローに影響します。この脆弱性は 2.13.0 で修正されました。(CVE-2026-48523)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - PyJWT 是 Python 中的 JSON Web 令牌實作。從 2.9.0 到 2.12.1，當使用 PyJWK 金鑰呼叫 jwt.decode（） 或 jwt.decode_complete（） 時，存在驗證者端演算法允許清單繞過。權杖標頭 alg 會根據呼叫端提供的演算法允許清單進行檢查，但簽章驗證是使用繫結至 PyJWK 物件的演算法來執行，而不是標頭演算法。控制已註冊 JWK/JWKS 私密金鑰的攻擊者可以使用不允許的演算法進行簽署，在 JWT 標頭中通告允許的演算法，但仍會被接受。此問題會影響記錄的 PyJWKClient.get_signing_key_from_jwt（...） 流程。此弱點已在 2.13.0 中修正。(CVE-2026-48523)

請注意，Nessus 依賴供應商報告的套件存在。

リモートの Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS ホストには、USN-8823-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    PyJWKClient の使用時、PyJWT が特定の URI を不適切に処理することがわかりました。リモートの攻撃者がこの問題を利用して、サーバー側リクエスト偽造 (SSRF) 攻撃を実行したり機密ローカルファイルを漏洩する可能性があります。この問題の影響を受けるのは、Ubuntu 22.04 LTS、Ubuntu 24.04 LTS、および Ubuntu 26.04 LTS のみです。(CVE-2026-48522)

    PyJWT が PyJWK キーでトークンをデコードするとき、暗号署名を不適切に検証することがわかりました。リモートの攻撃者がこの問題を利用して署名検証をバイパスしたり有効な JSON Web トークンを偽造する可能性があります。この問題の影響を受けるのは、Ubuntu 26.04 LTS のみです。(CVE-2026-48523)

    PyJWT が PyJWKClient の不明なキー ID を不適切に処理することがわかりました。リモートの攻撃者がこの問題を悪用して PyJWT に大量のネットワークリクエストを行わせ、サービス拒否を引き起こす可能性があります。この問題の影響を受けるのは、Ubuntu 24.04 LTS と Ubuntu 26.04 LTS のみです。(CVE-2026-48524)

    PyJWT が、デタッチした JWS トークン検証中にペイロードのデコーディングを不適切に処理していることが判明しました。
    リモートの攻撃者がこの問題を悪用して、PyJWT にリソースを過剰に消費させ、サービス拒否を引き起こす可能性があります。この問題の影響を受けるのは、Ubuntu 24.04 LTS と Ubuntu 26.04 LTS のみです。(CVE-2026-48525)

    HMAC と非対称アルゴリズムの両方を有効にしてトークンをデコードするとき、PyJWT が JSON Web キーを不適切に検証することがわかりました。リモート攻撃者がこの問題を悪用して有効なトークンを偽造し、認証をバイパスする可能性があります。(CVE-2026-48526)

Tenable は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS 主機上安裝的多個套件受到 USN-8823-1 公告中提及的多個弱點影響。

    據發現，PyJWT 在使用 PyJWKClient 時錯誤地處理了某些 URI。遠端攻擊者可能利用此漏洞進行伺服器端請求偽造（SSRF），或洩露敏感的本地檔案。此問題僅影響了 Ubuntu 22.04 LTS、Ubuntu 24.04 LTS 和 Ubuntu 26.04 LTS。(CVE-2026-48522)

    據發現，PyJWT 在使用 PyJWK 金鑰解碼令牌時錯誤地驗證了加密簽章。遠端攻擊者可能利用此漏洞繞過簽名驗證，並偽造有效的 JSON Web Tokens。這個問題只會影響 Ubuntu 26.04 LTS。(CVE-2026-48523)

    據發現，PyJWT 在 PyJWKClient 中對未知金鑰識別碼的處理方式有誤。遠端攻擊者可能利用此漏洞，導致 PyJWT 發出過多的網路請求，進而引發服務拒絕攻擊。此問題僅影響 Ubuntu 24.04 LTS 和 Ubuntu 26.04 LTS。(CVE-2026-48524)

    據發現，PyJWT 在分離的 JWS 權杖驗證期間錯誤地處理了負載解碼。
    遠端攻擊者可能利用此問題造成 PyJWT  過多消耗資源，進而導致拒絕服務。此問題僅影響 Ubuntu 24.04 LTS 和 Ubuntu 26.04 LTS。(CVE-2026-48525)

    據發現，PyJWT 在解碼同時啟用 HMAC 和非對稱演算法的權杖時，錯誤地驗證了 JSON Web 金鑰。遠端攻擊者可能利用此漏洞偽造有效的憑證，導致認證被繞過。(CVE-2026-48526)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory.

    This update for python-PyJWT fixes the following issues

    - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for     SSRF and       token forgery (bsc#1266798).
    - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()`     are called       with a PyJWK key (bsc#1266799).
    - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()`     leads to       unbounded JWKS endpoint requests and DoS (bsc#1266800).
    - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS     allows for DoS       (bsc#1266801).
    - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens     allows for       forged HS256 tokens (bsc#1266802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22170-1 advisory.

    This update for python-PyJWT fixes the following issues

    - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for     SSRF and       token forgery (bsc#1266798).
    - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()`     are called       with a PyJWK key (bsc#1266799).
    - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()`     leads to       unbounded JWKS endpoint requests and DoS (bsc#1266800).
    - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS     allows for DoS       (bsc#1266801).
    - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens     allows for       forged HS256 tokens (bsc#1266802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side     algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The     token header alg is checked against the caller-supplied algorithms allow-list, but signature verification     is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who     controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed     algorithm in the JWT header, and still be accepted. The issue affects the documented     PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0. (CVE-2026-48523)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0427 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-48525:
    PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS     tokens using the unencoded-payload option (b64: false, RFC 7797), PyJWT performs Base64URL decoding of     the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false,     PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In     practice, this turns the middle segment into an attacker-controlled work amplifier: a remote client can     supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if     the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies     detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.

    CVE-2026-48524:
    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces     a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting.
    Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The     vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with     sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting,     transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.

    CVE-2026-48523:
    PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side     algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The     token header alg is checked against the caller-supplied algorithms allow-list, but signature verification     is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who     controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed     algorithm in the JWT header, and still be accepted. The issue affects the documented     PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.

    CVE-2026-48522:
    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument     directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering     HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented     option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path     accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the     attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause     PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies     as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained     'plant a JWKS to forge tokens' scenario described in the original report requires additional application-     layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not     address. This vulnerability is fixed in 2.13.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2627-1 advisory.

    This update for python-PyJWT fixes the following issues

    - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for     SSRF and       token forgery (bsc#1266798).
    - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()`     are called       with a PyJWK key (bsc#1266799).
    - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS     allows for DoS       (bsc#1266801).
    - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens     allows for       forged HS256 tokens (bsc#1266802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8823-1 advisory.

    It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker     could possibly use this issue to perform server-side request forgery (SSRF) or expose sensitive local     files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48522)

    It was discovered that PyJWT incorrectly verified cryptographic signatures when decoding tokens with PyJWK     keys. A remote attacker could possibly use this issue to bypass signature verification and forge valid     JSON Web Tokens. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-48523)

    It was discovered that PyJWT incorrectly handled unknown key identifiers in PyJWKClient. A remote attacker     could possibly use this issue to cause PyJWT to make excessive network requests, resulting in a denial of     service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48524)

    It was discovered that PyJWT incorrectly handled payload decoding during detached JWS token verification.
    A remote attacker could possibly use this issue to cause PyJWT to consume excessive resources, resulting     in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48525)

    It was discovered that PyJWT incorrectly validated JSON Web Keys when decoding tokens with both HMAC and     asymmetric algorithms enabled. A remote attacker could possibly use this issue to forge valid tokens,     resulting in an authentication bypass. (CVE-2026-48526)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
443251	SCA: security update for pyjwt (GHSA-jq35-7prp-9v3f)	Tenable Self-Hosted Container Security	SCA Checks	2026/6/16	2026/7/2	medium
458729	Echo: pyjwt: security update to 2.13.0-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/2	medium
443251	SCA: security update for pyjwt (GHSA-jq35-7prp-9v3f)	Tenable Cloud Security	SCA Checks	2026/6/16	2026/7/2	medium
458729	Echo: pyjwt: security update to 2.13.0-1	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/2	medium
350973	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS：PyJWT 漏洞 (USN-8823-1)	Nessus	Ubuntu Local Security Checks	2026/9/29	2026/9/29	high
317757	Linux Distros 未修补的漏洞：CVE-2026-48523	Nessus	Misc.	2026/5/29	2026/9/29	medium
317757	Linux Distros のパッチ未適用の脆弱性: CVE-2026-48523	Nessus	Misc.	2026/5/29	2026/9/29	medium
317757	Linux Distros 未修補的弱點：CVE-2026-48523	Nessus	Misc.	2026/5/29	2026/9/29	medium
350973	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : PyJWT の脆弱性 (USN-8823-1)	Nessus	Ubuntu Local Security Checks	2026/9/29	2026/9/29	high
350973	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS：PyJWT 弱點 (USN-8823-1)	Nessus	Ubuntu Local Security Checks	2026/9/29	2026/9/29	high
323065	SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
322913	SUSE SLES16 Security Update : python-PyJWT (SUSE-SU-2026:22170-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
317757	Linux Distros Unpatched Vulnerability : CVE-2026-48523	Nessus	Misc.	2026/5/29	2026/9/29	medium
319736	TencentOS Server 4: python-jwt (TSSA-2026:0427)	Nessus	Tencent Local Security Checks	2026/6/8	2026/6/8	medium
323028	SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2627-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
350973	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : PyJWT vulnerabilities (USN-8823-1)	Nessus	Ubuntu Local Security Checks	2026/9/29	2026/9/29	high

检测

插件搜索

medium

medium

medium

medium

high

medium

medium

medium

high

high

high

high

medium

medium

high

high