atlassian-jwt-auth (>=2.7.0, <=3.0.0), credential-shield-fdelgados (>=0.0.1, <=2.0.0) +11 more potentially affected by CVE-2026-101917 via pyjwt (1.4.2)

pyjwt PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.7.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =0.0.1, =0.9.0, =5.4.0, =0.8.0, =0.3.3, =0.4.0 Source cves:...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-101917 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-101917 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-101917 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-102267 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-102267 Source advisory: OSV:PYSEC-2026-4144...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-102270 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-102270 Source advisory: OSV:PYSEC-2026-4148...

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

SummaryA service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated.PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts th...

PyJWT accepts public JWK containers as HMAC secrets

SummaryPyJWT 2.13.0 contains an incomplete defense against algorithm confusion whenan application mixes symmetric and asymmetric algorithms in one verificationpath. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when itis wrapped in a JWKS object, nested in an array, or represente...

PYSEC-2026-4149 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Summary HMACAlgorithm.preparekey blocks asymmetric keys from being used as HMAC secrets by searching for text markers only. It looks for -----BEGIN and for an ssh- prefix. The same key in DER form is binary ASN.1 and has neither marker, so it passes the check and is used as an HMAC secret. An...

PYSEC-2026-4143 PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...

PYSEC-2026-4147 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2026-102269 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2026-102269 Source advisory: OSV:PYSEC-2026-4147...

mbq-tokens (0.0.1), twilio (>=6.4.2a1, <=6.5.0) potentially affected by CVE-2026-101917 via pyjwt (1.5.0)

pyjwt PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - mbq-tokens 0.0.1 - twilio =6.4.2a1, =6.5.0 Source cves: CVE-2026-101917 Source advisory: OSV:PYSEC-2026-4140...

PYSEC-2026-4150 PyJWT BOM Bypass

Affected Package - Package: PyJWT pyjwt on PyPI - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- Root Cause PyJWT 2.13.0 introduced a guard i...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

SummaryPyJWT 2.13.0 accepts compact JWS signature segments containing characters thatare not in the Base64URL alphabet. Appending !!!! to a valid signature doesnot change the decoded signature bytes or authenticated claims, but it changesthe serialized token and its SHA-256 hash. An application...

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time:- The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop.- The verification key is...

CLSA-2026-1790843991 TuxCare security update for pyjwt (6 CVEs)

TuxCare rebuilt pyjwt to address 6 CVEs. Fixed in 2.8.0.post4+tuxcare...

CLSA-2026-1790839846 TuxCare security update for pyjwt (6 CVEs)

TuxCare rebuilt pyjwt to address 6 CVEs. Fixed in 2.10.1.post5+tuxcare...

PT-2026-105892

Summary PyJWT.decode/decode complete mutates a caller-supplied options dict in place whenever verify signature is falsy, adding verify exp/verify nbf/verify iat/verify aud/verify iss/verify sub/verify jti keys directly onto that object. If application code reuses the same options dict across call...

PT-2026-105893

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...