559 matches found
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
SummaryPyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a config...
6.5CVSS5.8AI score0.00364EPSS
SaveExploits0References6Affected Software1
20