Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pyjwt

24 known vulnerabilities (1 critical, 9 high, 11 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
2.15.1 (Sep 28, 2026): no advisory affects it
Newest unaffected release
2.15.1 (Sep 28, 2026), the latest release
Advisories
24 · 1 critical, 9 high, 11 medium, 2 low
Weekly downloads
177.7M
Dependents
49.1K
Releases
58 since 0.1.1 (Mar 6, 2011)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 24 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 24

  • CVE-2026-103001Medium 6.5

    PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

    Affected: from 2.11.0, through 2.13.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-102265Medium 5.3

    PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

    Affected: from 2.13.0, fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-102275Medium 6.5

    PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

    Affected: from 2.1.0, fixed in 2.15.0.

    Fixed in 2.15.0 (released Sep 23, 2026, 5 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-102274Medium 5.9

    PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

    Affected: from 2.9.0, fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT accepts public JWK containers as HMAC secrets

    Affected: from 2.13.0, fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT BOM Bypass

    Affected: from 2.13.0, fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

    Affected: from 2.4.0, fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-102270Medium 4.4

    PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

    Affected: fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-102269Medium 4.8

    PyJWT: Non-canonical signature segments enable raw-token revocation bypass

    Affected: fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-102268Critical 9.1

    PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

    Affected: fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT: PyJWKClient follows redirects when fetching JWKS

    Affected: fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

    Affected: from 2.13.0, fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-101918Medium 5.3

    PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

    Affected: from 2.0.0a1, fixed in 2.15.0.

    Fixed in 2.15.0 (released Sep 23, 2026, 5 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-101917Medium 5.3

    PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

    Affected: fixed in 2.14.0.

    Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-48525Medium 5.3

    PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

    Affected: from 2.8.0, fixed in 2.13.0.

    Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 2.15.1, is not affected.

Show all 24 advisoriesShow fewer advisories
  • CVE-2026-48523Medium 5.4

    PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

    Affected: from 2.9.0, fixed in 2.13.0; from 2.9.0, fixed in 2.12.1.

    Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

    Affected: fixed in 2.13.0.

    Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

    Affected: fixed in 2.13.0; from 2.0.0, fixed in 2.13.0.

    Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • CVE-2026-48522Medium 4.2

    PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

    Affected: from 2.0.0, fixed in 2.13.0; fixed in 2.13.0.

    Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

    Affected: fixed in 2.12.0.

    Fixed in 2.12.0 (released Mar 12, 2026, the day of disclosure).

    The latest release, 2.15.1, is not affected.

  • pyjwt v2.10.1 was discovered to contain weak encryption.

    Affected: through 2.10.1.

    Fixed in 2.11.0 (released Jan 30, 2026, 183 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.15.1, is not affected.

  • Issuer field partial matches allowed in pyjwt

    Affected: from 2.10.0, fixed in 2.10.1.

    Fixed in 2.10.1 (released Nov 28, 2024, 1 day before disclosure).

    The latest release, 2.15.1, is not affected.

  • Key confusion through non-blocklisted public key formats in PyJWT

    Affected: from 1.5.0, fixed in 2.4.0.

    Fixed in 2.4.0 (released May 12, 2022, 12 days before disclosure).

    The latest release, 2.15.1, is not affected.

  • In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.

    Affected: fixed in 1.5.1.

    Fixed in 1.5.1 (released Jun 22, 2017, 63 days before disclosure).

    The latest release, 2.15.1, is not affected.