P4Verified

CVE-2026-96512: Red Hat Enterprise Linux 10 (exact versions not specified); +4 more affected products

CVE-2026-96512 affects azl3 python-jwt 2.13.0-1 on Azure Linux 3.0. CVSS 3.1 base score 7.8 (HIGH, Vendor/CNA). EPSS 0.00133 (percentile 0.02375), scored 2026-10-05. Fixed version: 1820a349687522f51023d1ae5925125f59679a8c.

Affected technology

Red Hat Enterprise Linux 10 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Hardened Images · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 7 · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

An unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. Vendor/CNA’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.

Published 2026-10-07 11:46:40.869113+00:00

CWE: CWE-863
Product: azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
CCR priority: 31.2 /100 (P4)
CVSS 3.1: 7.8 /10 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.00133 · percentile 0.02386 · 2026-10-06
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-07 11:53:15.413517+00:00 UTC
GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC
Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-05 23:09:08.830529+00:00 UTC
OSV.dev · Source record · observed 2026-10-07 03:19:31.921362+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-96512.html