Skip to content
Noroxi

pyjwt project records

24 published records for vendor pyjwt project.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 22
  3. 24
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

24 records
  • CVE-2026-102268
    36Monitor

    PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-102266
    36Monitor

    PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

    CriticalCVSS 9.1No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-102267
    36Monitor

    PyJWT: PyJWKClient follows redirects when fetching JWKS

    CriticalCVSS 9.1No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-102275
    32Monitor

    PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

    HighCVSS 8.2No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2017-11424
    31Monitor

    In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.

    HighCVSS 7.5No exploitEPSS 1%

    pyjwt project · pyjwtAug 24, 2017

  • CVE-2022-29217
    30Monitor

    Key confusion through non-blocklisted public key formats in PyJWT

    HighCVSS 7.5No exploitEPSS 1%

    pyjwt project · pyjwtMay 24, 2022

  • CVE-2024-53861
    30Monitor

    Issuer field partial matches allowed in pyjwt

    HighCVSS 7.5No exploitEPSS 0%

    pyjwt project · pyjwtNov 29, 2024

  • CVE-2026-102274
    30Monitor

    PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

    HighCVSS 7.5No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-101917
    30Monitor

    PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

    HighCVSS 7.5No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-101918
    30Monitor

    PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

    HighCVSS 7.5No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-32597
    30Monitor

    PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

    HighCVSS 7.5No exploitEPSS 0%

    pyjwt project · pyjwtMar 13, 2026

  • CVE-2026-48526
    29Monitor

    PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

    HighCVSS 7.4No exploitEPSS 0%

    pyjwt project · pyjwtMay 28, 2026

  • CVE-2026-102272
    29Monitor

    PyJWT is a Python implementation of JSON Web Token standards.

    HighCVSS 7.4No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-102271
    29Monitor

    PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

    HighCVSS 7.4No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-102273
    29Monitor

    PyJWT accepts public JWK containers as HMAC secrets

    HighCVSS 7.4No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2025-45768
    28Monitor

    pyjwt v2.10.1 was discovered to contain weak encryption.

    HighCVSS 7.0No exploitEPSS 0%

    pyjwt project · pyjwtJul 31, 2025

  • CVE-2026-103001
    26Monitor

    PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

    MediumCVSS 6.5No exploitEPSS 0%

    pyjwt project · pyjwtSep 30, 2026

  • CVE-2026-48525
    21Monitor

    PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

    MediumCVSS 5.3No exploitEPSS 0%

    pyjwt project · pyjwtMay 28, 2026

  • CVE-2026-102265
    21Monitor

    PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

    MediumCVSS 5.3No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-102269
    21Monitor

    PyJWT: Non-canonical signature segments enable raw-token revocation bypass

    MediumCVSS 5.4No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-48523
    21Monitor

    PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

    MediumCVSS 5.4No exploitEPSS 0%

    pyjwt project · pyjwtMay 28, 2026

  • CVE-2026-102270
    19Monitor

    PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

    MediumCVSS 4.9No exploitEPSS 0%

    pyjwt project · pyjwtSep 28, 2026

  • CVE-2026-48522
    16Monitor

    PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

    MediumCVSS 4.2No exploitEPSS 0%

    pyjwt project · pyjwtMay 28, 2026

  • CVE-2026-48524
    14Monitor

    PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

    LowCVSS 3.7No exploitEPSS 0%

    pyjwt project · pyjwtMay 28, 2026