PYSEC-2022-259

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yaml

Aliases

• CVE-2022-39227
• GHSA-5p8v-58qm-c7fp

Published

2022-09-01T18:51:51Z

Modified

2023-11-08T04:10:15.713930Z

Details

An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication.

References

• https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9