pyjwt vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-PXH4-856F-4H89Highpyjwt: PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgeryCVE-2026-102275MediumPyJWT: PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionCVE-2026-103001MediumPyJWT: PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-101918MediumPyJWT: PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)CVE-2026-102270Mediumpyjwt: PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.CVE-2026-102266HighPyJWT: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationCVE-2026-102265MediumpyJWT: PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerCVE-2026-102269MediumPyJWT: PyJWT: Non-canonical signature segments enable raw-token revocation bypassCVE-2026-102268CriticalPyJWT: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardCVE-2026-102273HighPyJWT: PyJWT accepts public JWK containers as HMAC secretsCVE-2026-102267HighPyJWT: PyJWT: PyJWKClient follows redirects when fetching JWKSCVE-2026-102271Highpyjwt: PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardCVE-2026-102272HighPyJWT: PyJWT BOM BypassCVE-2026-101917Mediumpyjwt: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)CVE-2026-102274MediumPyJWT: PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetCVE-2026-48525Mediumpyjwt: PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSCVE-2026-48522MediumPyJWT: PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemesCVE-2026-48526Highpyjwt: PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedCVE-2026-48523Mediumpyjwt: PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keysCVE-2026-48524Lowpyjwt: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)CVE-2026-32597HighPyJWT: PyJWT accepts unknown `crit` header extensionsCVE-2024-53861LowPyJWT: PyJWT Issuer field partial matches allowedCVE-2022-29217Highpyjwt: Key confusion through non-blocklisted public key formatsCVE-2017-11424Highpyjwt: PyJWT vulnerable to key confusion attacks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo