PP
Vendor
Pyjwt Project
24
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-103001 | PY Pyjwt Pyjwt Project | 6.5 | Sep 30 | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse |
| CVE-2026-102265 | PY Pyjwt Pyjwt Project | 5.3 | Sep 28 | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header |
| CVE-2026-102275 | PY Pyjwt Pyjwt Project | 8.2 | Sep 28 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion |
| CVE-2026-102274 | PY Pyjwt Pyjwt Project | 7.5 | Sep 28 | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set |
| CVE-2026-102273 | PY Pyjwt Pyjwt Project | 7.4 | Sep 28 | PyJWT accepts public JWK containers as HMAC secrets |
| CVE-2026-102272 | PY Pyjwt Pyjwt Project | 7.4 | Sep 28 | PyJWT BOM Bypass |
| CVE-2026-102271 | PY Pyjwt Pyjwt Project | 7.4 | Sep 28 | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard |
| CVE-2026-102270 | PY Pyjwt Pyjwt Project | 4.9 | Sep 28 | PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. |
| CVE-2026-102269 | PY Pyjwt Pyjwt Project | 5.4 | Sep 28 | PyJWT: Non-canonical signature segments enable raw-token revocation bypass |
| CVE-2026-102268 | PY Pyjwt Pyjwt Project | 9.1 | Sep 28 | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard |
| CVE-2026-102267 | PY Pyjwt Pyjwt Project | 9.1 | Sep 28 | PyJWT: PyJWKClient follows redirects when fetching JWKS |
| CVE-2026-102266 | PY Pyjwt Pyjwt Project | 9.1 | Sep 28 | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation |
| CVE-2026-101918 | PY Pyjwt Pyjwt Project | 7.5 | Sep 28 | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) |
| CVE-2026-101917 | PY Pyjwt Pyjwt Project | 7.5 | Sep 28 | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) |
| CVE-2026-48525 | PY Pyjwt Pyjwt Project | 5.3 | May 28 | PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS |
| CVE-2026-48523 | PY Pyjwt Pyjwt Project | 5.4 | May 28 | PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys |
| CVE-2026-48526 | PY Pyjwt Pyjwt Project | 7.4 | May 28 | PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed |
| CVE-2026-48524 | PY Pyjwt Pyjwt Project | 3.7 | May 28 | PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) |
| CVE-2026-48522 | PY Pyjwt Pyjwt Project | 4.2 | May 28 | PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes |
| CVE-2026-32597 | PY Pyjwt Pyjwt Project | 7.5 | Mar 12 | PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) |
| CVE-2025-45768 | PY Pyjwt Pyjwt Project | 7.0 | Jul 31 | pyjwt v2.10.1 was discovered to contain weak encryption |
| CVE-2024-53861 | PY Pyjwt Pyjwt Project | 7.5 | Nov 29 | pyjwt is a JSON Web Token implementation in Python |
| CVE-2022-29217 | PY Pyjwt Pyjwt Project | 7.5 | May 24 | PyJWT is a Python implementation of RFC 7519 |
| CVE-2017-11424 | PY Pyjwt Pyjwt Project | 7.5 | Aug 24 | In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys |