pyjwt
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 48 advisory(ies) without a verdict
Advisories (48)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2gx3-rcp4-g85q PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) | < 2.14.0 | Undetermined |
| GHSA-42vr-xj54-vc7v PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) | 2.0.0a1 – < 2.15.0 | Undetermined |
| GHSA-752w-5fwx-jx9f PyJWT accepts unknown `crit` header extensions | < 2.12.0 | Undetermined |
| GHSA-75c5-xw7c-p5pm PyJWT Issuer field partial matches allowed | 2.10.0 – < 2.10.1 | Undetermined |
| GHSA-8wjv-2p76-3863 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header | 2.13.0 – < 2.14.0 | Undetermined |
| GHSA-993g-76c3-p5m4 PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes | 2.0.0 – < 2.13.0 | Undetermined |
| GHSA-9j54-fg26-wv3r PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | 2.13.0 – < 2.14.0 | Undetermined |
| GHSA-9v7f-9g4p-ffgj PyJWT: PyJWKClient follows redirects when fetching JWKS | < 2.14.0 | Undetermined |
| GHSA-ffc3-869f-jxw9 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard | < 2.14.0 | Undetermined |
| GHSA-ffqj-6fqr-9h24 Key confusion through non-blocklisted public key formats | 1.5.0 – < 2.4.0 | Undetermined |
| GHSA-fhv5-28vv-h8m8 PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) | 2.0.0 – < 2.13.0 | Undetermined |
| GHSA-gvp8-978c-rx2q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse | 2.11.0 – 2.13.0 | Undetermined |
| GHSA-hxm8-2xgr-2p9m PyJWT: Non-canonical signature segments enable raw-token revocation bypass | < 2.14.0 | Undetermined |
| GHSA-jq35-7prp-9v3f PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys | 2.9.0 – < 2.13.0 | Undetermined |
| GHSA-jwrc-g2q2-pq5p PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. | < 2.14.0 | Undetermined |
| GHSA-p4g4-x82p-q773 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | 2.4.0 – < 2.14.0 | Undetermined |
| GHSA-pxh4-856f-4h89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery | < 2.14.0 | Undetermined |
| GHSA-r6x4-923q-g947 PyJWT BOM Bypass | 2.13.0 – < 2.14.0 | Undetermined |
| GHSA-r9jw-mwhq-wp62 PyJWT vulnerable to key confusion attacks | < 1.5.1 | Undetermined |
| GHSA-w2cx-738m-mc7w PyJWT accepts public JWK containers as HMAC secrets | 2.13.0 – < 2.14.0 | Undetermined |
| GHSA-w6j9-cwv2-h6wq PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set | 2.9.0 – < 2.14.0 | Undetermined |
| GHSA-w7vc-732c-9m39 PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS | 2.8.0 – < 2.13.0 | Undetermined |
| GHSA-x33g-cr3x-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion | 2.1.0 – < 2.15.0 | Undetermined |
| GHSA-xgmm-8j9v-c9wx PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed | < 2.13.0 | Undetermined |
| PYSEC-2017-24 In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PE | < 1.5.1 | Undetermined |
| PYSEC-2022-202 PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choos | < 9c528670c455b8d948aff95ed50e22940d1ad3fc ; 1.5.0 – < 2.4.0 | Undetermined |
| PYSEC-2025-183 pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses th | ≤ 2.10.1 | Undetermined |
| PYSEC-2026-120 PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. W | < 2.12.0 | Undetermined |
| PYSEC-2026-175 PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python | < 2.13.0 | Undetermined |
| PYSEC-2026-176 PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_c | 2.9.0 – < 2.12.1 | Undetermined |
| PYSEC-2026-177 PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JW | < 2.13.0 | Undetermined |
| PYSEC-2026-178 PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, R | 2.8.0 – < 2.13.0 | Undetermined |
| PYSEC-2026-179 PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC al | < 2.13.0 | Undetermined |
| PYSEC-2026-1814 PyJWT Issuer field partial matches allowed | 2.10.0 – < 2.10.1 | Undetermined |
| PYSEC-2026-4140 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) | < 2.14.0 | Undetermined |
| PYSEC-2026-4141 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) | 2.0.0a1 – < 2.15.0 | Undetermined |
| PYSEC-2026-4142 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header | 2.13.0 – < 2.14.0 | Undetermined |
| PYSEC-2026-4143 PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | 2.13.0 – < 2.14.0 | Undetermined |
| PYSEC-2026-4144 PyJWT: PyJWKClient follows redirects when fetching JWKS | < 2.14.0 | Undetermined |
| PYSEC-2026-4145 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard | < 2.14.0 | Undetermined |
| PYSEC-2026-4146 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse | 2.11.0 – 2.13.0 | Undetermined |
| PYSEC-2026-4147 PyJWT: Non-canonical signature segments enable raw-token revocation bypass | < 2.14.0 | Undetermined |
| PYSEC-2026-4148 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. | < 2.14.0 | Undetermined |
| PYSEC-2026-4149 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | 2.4.0 – < 2.14.0 | Undetermined |
| PYSEC-2026-4150 PyJWT BOM Bypass | 2.13.0 – < 2.14.0 | Undetermined |
| PYSEC-2026-4151 PyJWT accepts public JWK containers as HMAC secrets | 2.13.0 – < 2.14.0 | Undetermined |
| PYSEC-2026-4152 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set | 2.9.0 – < 2.14.0 | Undetermined |
| PYSEC-2026-4183 PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because pri | 2.1.0 – < 2.15.0 | Undetermined |
Sources
| Source | Licence |
|---|