pyjwt vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48525Mediumpyjwt: PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false…CVE-2026-48522MediumPyJWT: PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via…CVE-2026-48526Highpyjwt: PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are…CVE-2026-48523Mediumpyjwt: PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys CVE-2026-48524Lowpyjwt: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)CVE-2026-32597HighPyJWT: PyJWT accepts unknown `crit` header extensions CVE-2024-53861LowPyJWT: PyJWT Issuer field partial matches allowed CVE-2022-29217Highpyjwt: Key confusion through non-blocklisted public key formats CVE-2017-11424Highpyjwt: PyJWT vulnerable to key confusion attacks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo