python · pyjwtHeads-up
pyjwt: Unbounded JWKS fetch on unknown kid and cache wipe on network error
PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Additionally, fet
What changed
PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Additionally, fetch_data() finally block clears the JWKS cache on network error.
Who it affects
All versions with PyJWKClient (2.4.0 through 2.12.1)
What to do today
Apply the suggested fix: add refresh cooldown and move cache write from finally to else block.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · pyjwt