# pyjwt (PyPI) vulnerabilities 24 known vulnerabilities (1 critical, 9 high, 11 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.15.1 (Sep 28, 2026): no advisory affects it - Newest unaffected release: 2.15.1 (Sep 28, 2026), the latest release - Weekly downloads: 177.7M - Dependents: 49.1K - Releases: 58 since 0.1.1 (Mar 6, 2011) - Registry: https://pypi.org/project/pyjwt/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-103001: 2.11.0 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102265: 2.13.0 (2.14.0 is outside it) - CVE-2026-102275: 2.1.0 to 2.14.0 (2.15.0 is outside it) - CVE-2026-102274: 2.9.0 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102273: 2.13.0 (2.14.0 is outside it) - CVE-2026-102272: 2.13.0 (2.14.0 is outside it) - CVE-2026-102271: 2.4.0 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102270: 0.1.1 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102269: 0.1.1 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102268: 0.1.1 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102267: 0.1.1 to 2.13.0 (2.14.0 is outside it) - CVE-2026-102266: 2.13.0 (2.14.0 is outside it) - CVE-2026-101918: 2.0.0a1 to 2.14.0 (2.15.0 is outside it) - CVE-2026-101917: 0.1.1 to 2.13.0 (2.14.0 is outside it) - CVE-2026-48525: 2.8.0 to 2.12.1 (2.13.0 is outside it) - CVE-2026-48523: 2.9.0 to 2.12.1 (2.13.0 is outside it) - CVE-2026-48526: 0.1.1 to 2.12.1 (2.13.0 is outside it) - CVE-2026-48524: 0.1.1 to 2.12.1 (2.13.0 is outside it) - CVE-2026-48522: 0.1.1 to 2.12.1 (2.13.0 is outside it) - CVE-2026-32597: 0.1.1 to 2.11.0 (2.12.0 is outside it) - CVE-2025-45768: 0.1.1 to 2.10.1 (2.11.0 is outside it) - CVE-2024-53861: 2.10.0 (2.10.1 is outside it) - CVE-2022-29217: 1.5.0 to 2.3.0 (2.4.0 is outside it) - CVE-2017-11424: 0.1.1 to 1.5.0 (1.5.1 is outside it) ## Advisories (24) ### [CVE-2026-103001](https://cve.now/CVE-2026-103001): PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse - Severity: Medium 6.5 - Published: Sep 30, 2026 - Affected: from 2.11.0, through 2.13.0. - Fixed in 2.14.0 (released Sep 11, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102265](https://cve.now/CVE-2026-102265): PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header - Severity: Medium 5.3 - Published: Sep 28, 2026 - Affected: from 2.13.0, fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102275](https://cve.now/CVE-2026-102275): PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion - Severity: Medium 6.5 - Published: Sep 28, 2026 - Affected: from 2.1.0, fixed in 2.15.0. - Fixed in 2.15.0 (released Sep 23, 2026, 5 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102274](https://cve.now/CVE-2026-102274): PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set - Severity: Medium 5.9 - Published: Sep 28, 2026 - Affected: from 2.9.0, fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102273](https://cve.now/CVE-2026-102273): PyJWT accepts public JWK containers as HMAC secrets - Severity: High 7.4 - Published: Sep 28, 2026 - Affected: from 2.13.0, fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102272](https://cve.now/CVE-2026-102272): PyJWT BOM Bypass - Severity: High 7.4 - Published: Sep 28, 2026 - Affected: from 2.13.0, fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102271](https://cve.now/CVE-2026-102271): PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard - Severity: High 7.4 - Published: Sep 28, 2026 - Affected: from 2.4.0, fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102270](https://cve.now/CVE-2026-102270): PyJWT: ReDoS vulnerability when calling the \`is\_pem\_format\` function. - Severity: Medium 4.4 - Published: Sep 28, 2026 - Affected: fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102269](https://cve.now/CVE-2026-102269): PyJWT: Non-canonical signature segments enable raw-token revocation bypass - Severity: Medium 4.8 - Published: Sep 28, 2026 - Affected: fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102268](https://cve.now/CVE-2026-102268): PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard - Severity: Critical 9.1 - Published: Sep 28, 2026 - Affected: fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102267](https://cve.now/CVE-2026-102267): PyJWT: PyJWKClient follows redirects when fetching JWKS - Severity: High 7.4 - Published: Sep 28, 2026 - Affected: fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-102266](https://cve.now/CVE-2026-102266): PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation - Severity: High 7.4 - Published: Sep 28, 2026 - Affected: from 2.13.0, fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-101918](https://cve.now/CVE-2026-101918): PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get\_signing\_key\_from\_jwt / verify\_signature=False) - Severity: Medium 5.3 - Published: Sep 28, 2026 - Affected: from 2.0.0a1, fixed in 2.15.0. - Fixed in 2.15.0 (released Sep 23, 2026, 5 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-101917](https://cve.now/CVE-2026-101917): PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) - Severity: Medium 5.3 - Published: Sep 28, 2026 - Affected: fixed in 2.14.0. - Fixed in 2.14.0 (released Sep 11, 2026, 17 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-48525](https://cve.now/CVE-2026-48525): PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS - Severity: Medium 5.3 - Published: May 28, 2026 - Affected: from 2.8.0, fixed in 2.13.0. - Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-48523](https://cve.now/CVE-2026-48523): PyJWT: Algorithm allow-list bypass when decoding with \`PyJWK\` / \`PyJWKClient\` keys - Severity: Medium 5.4 - Published: May 28, 2026 - Affected: from 2.9.0, fixed in 2.13.0; from 2.9.0, fixed in 2.12.1. - Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-48526](https://cve.now/CVE-2026-48526): PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed - Severity: High 7.4 - Published: May 28, 2026 - Affected: fixed in 2.13.0. - Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-48524](https://cve.now/CVE-2026-48524): PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) - Severity: Low 3.7 - Published: May 28, 2026 - Affected: fixed in 2.13.0; from 2.0.0, fixed in 2.13.0. - Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-48522](https://cve.now/CVE-2026-48522): PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes - Severity: Medium 4.2 - Published: May 28, 2026 - Affected: from 2.0.0, fixed in 2.13.0; fixed in 2.13.0. - Fixed in 2.13.0 (released May 21, 2026, 7 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2026-32597](https://cve.now/CVE-2026-32597): PyJWT accepts unknown \`crit\` header extensions (RFC 7515 ยง4.1.11 MUST violation) - Severity: High 7.5 - Published: Mar 12, 2026 - Affected: fixed in 2.12.0. - Fixed in 2.12.0 (released Mar 12, 2026, the day of disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2025-45768](https://cve.now/CVE-2025-45768): pyjwt v2.10.1 was discovered to contain weak encryption. - Severity: High 7.0 - Published: Jul 31, 2025 - Affected: through 2.10.1. - Fixed in 2.11.0 (released Jan 30, 2026, 183 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.15.1, is not affected. ### [CVE-2024-53861](https://cve.now/CVE-2024-53861): Issuer field partial matches allowed in pyjwt - Severity: Low 2.2 - Published: Nov 29, 2024 - Affected: from 2.10.0, fixed in 2.10.1. - Fixed in 2.10.1 (released Nov 28, 2024, 1 day before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2022-29217](https://cve.now/CVE-2022-29217): Key confusion through non-blocklisted public key formats in PyJWT - Severity: High 7.4 - Published: May 24, 2022 - Affected: from 1.5.0, fixed in 2.4.0. - Fixed in 2.4.0 (released May 12, 2022, 12 days before disclosure). - The latest release, 2.15.1, is not affected. ### [CVE-2017-11424](https://cve.now/CVE-2017-11424): In PyJWT 1.5.0 and below the \`invalid\_strings\` check in \`HMACAlgorithm.prepare\_key\` does not account for all PEM encoded public keys. - Severity: Unrated - Published: Aug 24, 2017 - Affected: fixed in 1.5.1. - Fixed in 1.5.1 (released Jun 22, 2017, 63 days before disclosure). - The latest release, 2.15.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pyjwt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.