What’s Vulnerable › Products
jpadilla pyjwt vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.
Check whether your jpadilla pyjwt version is affected
Latest jpadilla pyjwt vulnerabilities
- CVE-2026-103001 — PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse (CVSS 6.5)
- CVE-2026-102275 — PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion (CVSS 8.2)
- CVE-2026-102274 — PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set (CVSS 7.5)
- CVE-2026-102273 — PyJWT accepts public JWK containers as HMAC secrets (CVSS 7.4)
- CVE-2026-102272 — PyJWT BOM Bypass (CVSS 7.4)
- CVE-2026-102271 — PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard (CVSS 7.4)
- CVE-2026-102270 — PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. (CVSS 4.9)
- CVE-2026-102269 — PyJWT: Non-canonical signature segments enable raw-token revocation bypass (CVSS 5.4)
- CVE-2026-102268 — PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard (CVSS 9.1)
- CVE-2026-102267 — PyJWT: PyJWKClient follows redirects when fetching JWKS (CVSS 9.1)
- CVE-2026-102266 — PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation (CVSS 9.1)
- CVE-2026-102265 — PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header (CVSS 5.3)
- CVE-2026-101918 — PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) (CVSS 7.5)
- CVE-2026-101917 — PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) (CVSS 7.5)
- CVE-2026-48526 — PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed (CVSS 7.4)
- CVE-2026-48525 — PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS (CVSS 5.3)
- CVE-2026-48524 — PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) (CVSS 3.7)
- CVE-2026-48523 — PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys (CVSS 5.4)
- CVE-2026-48522 — PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes (CVSS 4.2)
- CVE-2026-32597 — PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) (CVSS 7.5)
- CVE-2025-45768 — (CVSS 7.0)
- CVE-2024-53861 — Issuer field partial matches allowed in pyjwt (CVSS 7.5)
- CVE-2022-29217 — Key confusion through non-blocklisted public key formats in PyJWT (CVSS 7.5)
- CVE-2017-11424 — (CVSS 7.5)