PY
Product
pyjwt
20
CVEs
0
On KEV
9.1
Max CVSS
1
New 30D
Severity mix
Critical 3High 9Medium 7Low 1
Watch
Add pyjwt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-103001 | 6.5 | Sep 30 | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse Affected: >= 2.11.0, <= 2.13.0 |
| CVE-2026-102269 | 5.4 | Sep 28 | PyJWT: Non-canonical signature segments enable raw-token revocation bypass Affected: < 2.14.0 |
| CVE-2026-48523 | 5.4 | May 28 | PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys Affected: >= 2.9.0, < 2.13.0 |
| CVE-2026-102265 | 5.3 | Sep 28 | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header Affected: >= 2.13.0, < 2.14.0 |
| CVE-2026-48525 | 5.3 | May 28 | PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS Affected: >= 2.8.0, < 2.13.0 |
| CVE-2026-102270 | 4.9 | Sep 28 | PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. Affected: < 2.14.0 |
| CVE-2026-48522 | 4.2 | May 28 | PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes Affected: < 2.13.0 |
Showing 7