360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102265 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

PYSEC-2026-4140 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...

eve-auth-jwt (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-102268 via pyjwt (1.0.1)

pyjwt PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - eve-auth-jwt =1.0.0, =1.0.1 Source cves: CVE-2026-102268 Source advisory: OSV:PYSEC-2026-4145...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2026-101917 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

SummaryThere is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. DetailsThe problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

atlassian-jwt-auth (>=2.7.0, <=3.0.0), credential-shield-fdelgados (>=0.0.1, <=2.0.0) +11 more potentially affected by CVE-2026-102267 via pyjwt (1.4.2)

pyjwt PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.7.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =0.0.1, =0.9.0, =5.4.0, =0.8.0, =0.3.3, =0.4.0 Source cves:...

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

SummaryA malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.fromjwk can raise a plain ValueError that isn't caught by PyJWKSet's per-key error-skipping logic. Affected component / version- Package: PyJWT PyPI, ecosystem pip- Files:...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-102267 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-102267 Source advisory: OSV:PYSEC-2026-4144...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-102269 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-102269 Source advisory: OSV:PYSEC-2026-4147...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-102268 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-102268 Source advisory: OSV:PYSEC-2026-4145...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-101917 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-102270 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-102270 Source advisory: OSV:PYSEC-2026-4148...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-101917 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-101917 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-102267 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-102267 Source advisory: OSV:PYSEC-2026-4144...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-102270 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-102270 Source advisory: OSV:PYSEC-2026-4148...

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

SummaryA service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated.PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts th...

PyJWT accepts public JWK containers as HMAC secrets

SummaryPyJWT 2.13.0 contains an incomplete defense against algorithm confusion whenan application mixes symmetric and asymmetric algorithms in one verificationpath. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when itis wrapped in a JWKS object, nested in an array, or represente...

PYSEC-2026-4149 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Summary HMACAlgorithm.preparekey blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for -----BEGIN and for an ssh- prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is used as an HMAC secret. An...

PYSEC-2026-4143 PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...