PY
Product
Pyjwt
24
CVEs
0
On KEV
9.1
Max CVSS
1
New 30D
Severity mix
Critical 3High 13Medium 7Low 1
Watch
Add Pyjwt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102275 | 8.2 | Sep 28 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion Affected: 2.1.0 before 2.15.0 |
| CVE-2026-102274 | 7.5 | Sep 28 | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set Affected: 2.9.0 before 2.14.0 |
| CVE-2026-101918 | 7.5 | Sep 28 | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) Affected: 2.0.0 before 2.15.0 |
| CVE-2026-101917 | 7.5 | Sep 28 | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) Affected: before 2.14.0 |
| CVE-2026-32597 | 7.5 | Mar 12 | PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) Affected: before 2.12.0 |
| CVE-2024-53861 | 7.5 | Nov 29 | Issuer field partial matches allowed in pyjwt Affected: 2.10.0 |
| CVE-2022-29217 | 7.5 | May 24 | PyJWT is a Python implementation of RFC 7519 Affected: 1.5.0 before 2.4.0 |
| CVE-2017-11424 | 7.5 | Aug 24 | In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys Affected: through 1.5.0 |
| CVE-2026-102273 | 7.4 | Sep 28 | PyJWT accepts public JWK containers as HMAC secrets Affected: 2.13.0 |
| CVE-2026-102272 | 7.4 | Sep 28 | PyJWT BOM Bypass Affected: 2.13.0 |
| CVE-2026-102271 | 7.4 | Sep 28 | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard Affected: 2.4.0 before 2.14.0 |
| CVE-2026-48526 | 7.4 | May 28 | PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed Affected: before 2.13.0 |
| CVE-2025-45768 | 7.0 | Jul 31 | pyjwt v2.10.1 was discovered to contain weak encryption Affected: 2.10.1 |
Showing 13