PyPI - OSV

GHSA-x33g-cr3x-6449

PyPI/pyjwt

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion 5 hours ago

Fix available
Severity - 6.5 (Medium)

PYSEC-2026-4146

PyPI/pyjwt

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 4 days ago

No fix available
Severity - 6.5 (Medium)

PYSEC-2026-4141

PyPI/pyjwt

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 4 days ago

Fix available
Severity - 5.3 (Medium)

PYSEC-2026-4148

PyPI/pyjwt

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. 4 days ago

Fix available
Severity - 4.4 (Medium)

PYSEC-2026-4143

PyPI/pyjwt

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation 4 days ago

Fix available
Severity - 7.4 (High)

PYSEC-2026-4142

PyPI/pyjwt

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header 4 days ago

Fix available
Severity - 5.3 (Medium)

PYSEC-2026-4147

PyPI/pyjwt

PyJWT: Non-canonical signature segments enable raw-token revocation bypass 4 days ago

Fix available
Severity - 4.8 (Medium)

PYSEC-2026-4145

PyPI/pyjwt

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 4 days ago

Fix available
Severity - 9.1 (Critical)

PYSEC-2026-4151

PyPI/pyjwt

PyJWT accepts public JWK containers as HMAC secrets 4 days ago

Fix available
Severity - 7.4 (High)

PYSEC-2026-4144

PyPI/pyjwt

PyJWT: PyJWKClient follows redirects when fetching JWKS 4 days ago

Fix available
Severity - 7.4 (High)

PYSEC-2026-4149

PyPI/pyjwt

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 4 days ago

Fix available
Severity - 7.4 (High)

PYSEC-2026-4150

PyPI/pyjwt

PyJWT BOM Bypass 4 days ago

Fix available
Severity - 7.4 (High)

PYSEC-2026-4140

PyPI/pyjwt

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) 4 days ago

Fix available
Severity - 5.3 (Medium)

PYSEC-2026-4152

PyPI/pyjwt

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set 4 days ago

Fix available
Severity - 5.9 (Medium)

GHSA-gvp8-978c-rx2q

PyPI/pyjwt

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 5 days ago

No fix available
Severity - 6.5 (Medium)

GHSA-42vr-xj54-vc7v

PyPI/pyjwt

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 5 days ago

Fix available
Severity - 5.3 (Medium)

Vulnerabilities