jpadilla pyjwt
22 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-103001 | >= 2.11.0, <= 2.13.0 | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-102265 | >= 2.13.0, < 2.14.0 | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-102275 | >= 2.1.0, < 2.15.0 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion | HIGH 8.2 | 0.2 % | ||
| CVE-2026-102274 | >= 2.9.0, < 2.14.0 | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set | HIGH 7.5 | 0.5 % | ||
| CVE-2026-102273 | >= 2.13.0, < 2.14.0 | PyJWT accepts public JWK containers as HMAC secrets | HIGH 7.4 | 0.2 % | ||
| CVE-2026-102272 | >= 2.13.0, < 2.14.0 | PyJWT BOM Bypass | HIGH 7.4 | 0.2 % | ||
| CVE-2026-102271 | >= 2.4.0, < 2.14.0 | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | HIGH 7.4 | 0.2 % | ||
| CVE-2026-102270 | < 2.14.0 | PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. | MEDIUM 4.9 | 0.2 % | ||
| CVE-2026-102269 | < 2.14.0 | PyJWT: Non-canonical signature segments enable raw-token revocation bypass | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-102268 | < 2.14.0 | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-102267 | < 2.14.0 | PyJWT: PyJWKClient follows redirects when fetching JWKS | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-102266 | >= 2.13.0, < 2.14.0 | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-101918 | >= 2.0.0a1, < 2.15.0 | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-101917 | < 2.14.0 | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-48525 | >= 2.8.0, < 2.13.0 | PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-48523 | >= 2.9.0, < 2.13.0 | PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-48526 | < 2.13.0 | PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed | HIGH 7.4 | 0.4 % | ||
| CVE-2026-48524 | < 2.13.0 | PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) | LOW 3.7 | 0.4 % | ||
| CVE-2026-48522 | < 2.13.0 | PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-32597 | < 2.12.0 | PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | HIGH 7.5 | 0.3 % | ||
| CVE-2024-53861 | = 2.10.0 | Issuer field partial matches allowed in pyjwt | HIGH 7.5 | 0.8 % | ||
| CVE-2022-29217 | >= 1.5.0, < 2.4.0 | Key confusion through non-blocklisted public key formats in PyJWT | HIGH 7.5 | 1.4 % |