PT-2026-108340

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102274: Improper Handling of Exceptional Conditions

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.fromjwk in jwt/apijwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable...

PT-2026-108343

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from jwk in jwt/api jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usabl...

PT-2026-108337

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get signing key from jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. ...

CVE-2026-102265: Uncontrolled Recursion

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

CVE-2026-102275: Insufficient Verification of Data Authenticity

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...

USN-8823-1: PyJWT vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

USN-8823-1 pyjwt vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-jwt (UTSA-2026-054077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054077 advisory. PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

SUSE CVE-2026-32597

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

PT-2026-102374

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.1.0 through 2.14.0 Description The OKPAlgorithm.from jwk function in jwt/algorithms.py fails to compare the public key derived from d with x during the private-JWK import process. This occurs when an OKP private JWK provides...

CVE-2026-102270

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:50+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p...

CVE-2026-102266

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:49+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r 2026-09-30 13:30:31+00:00| seen| https://gist.github.com/alon710/021c63a7b1d8134c56a782a255bf9e1a 2026-10-14 15:10:03+00:00|...

CVE-2026-102265

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:22+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863 2026-09-30 14:30:31+00:00| seen| https://gist.github.com/alon710/f6dca5418926a6ce4c4f68d94001f804...

CVE-2026-102271

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:21+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773...

CVE-2026-102272

creationtimestamp| type| source ---|---|--- 2026-09-11 13:35:57+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947...

PT-2026-102360

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function in jwt/utils.py fails to recognize all PEM representations accepted by the cryptography loader. This occurs when an application uses both HMAC and asymmetric algorithms and...

PT-2026-102363

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.4.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the asymmetric-key guard relies on textual markers that are absent from DER Distinguished Encoding Rules encoding. This occurs when an...

PT-2026-102347

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The get signing key from jwt function is affected by a flaw where unknown kid Key ID values trigger forced refreshes of the JSON Web Key Set JWKS without a negative cache or minimum refresh interval...