PT-2026-108324

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

CVE-2026-102271: Improper Verification of Cryptographic Signature

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and...

PT-2026-108340

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

PT-2026-108343

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from jwk in jwt/api jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usabl...

CVE-2026-102274: Improper Handling of Exceptional Conditions

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.fromjwk in jwt/apijwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable...

CVE-2026-102266: Improper Verification of Cryptographic Signature

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

USN-8823-1 pyjwt vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

USN-8823-1: PyJWT vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-jwt (UTSA-2026-054077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054077 advisory. PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

SUSE CVE-2026-32597

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

PT-2026-102374

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.1.0 through 2.14.0 Description The OKPAlgorithm.from jwk function in jwt/algorithms.py fails to compare the public key derived from d with x during the private-JWK import process. This occurs when an OKP private JWK provides...

CVE-2026-102270

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:50+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p...

CVE-2026-102266

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:49+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r 2026-09-30 13:30:31+00:00| seen| https://gist.github.com/alon710/021c63a7b1d8134c56a782a255bf9e1a 2026-10-14 15:10:03+00:00|...

CVE-2026-102265

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:22+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863 2026-09-30 14:30:31+00:00| seen| https://gist.github.com/alon710/f6dca5418926a6ce4c4f68d94001f804...

CVE-2026-102271

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:21+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773...

CVE-2026-102272

creationtimestamp| type| source ---|---|--- 2026-09-11 13:35:57+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947...

PT-2026-102360

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function in jwt/utils.py fails to recognize all PEM representations accepted by the cryptography loader. This occurs when an application uses both HMAC and asymmetric algorithms and...

PT-2026-102347

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The get signing key from jwt function is affected by a flaw where unknown kid Key ID values trigger forced refreshes of the JSON Web Key Set JWKS without a negative cache or minimum refresh interval...

PT-2026-102363

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.4.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the asymmetric-key guard relies on textual markers that are absent from DER Distinguished Encoding Rules encoding. This occurs when an...