PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

SummaryPyJWKClient.getsigningkeyfromjwttoken — the first step of the JWKSverification flow documented in docs/usage.rst — must decode a token'spayload before its signature can be checked, viajwt.apijwt.decodecompletetoken, options="verifysignature": False.That call parses the payload with...