10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1596 more potentially affected by CVE-2026-48524 via pyjwt (>=2.0.0a2, <=2.12.1)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48524 Source advisory: SNYK:PYTHON-PYJWT-17054465...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Base64URL decoding process. An attacker can cause excessive CPU and memory consumption by supplying an arbitrarily large payload segment when verifying detached JWS tokens wit...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1596 more potentially affected by CVE-2026-48525 via pyjwt (>=2.0.0a2, <=2.12.1)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48525 Source advisory: SNYK:PYTHON-PYJWT-17053409...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1596 more potentially affected by CVE-2026-48526 via pyjwt (>=2.0.0a2, <=2.12.1)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48526 Source advisory: SNYK:PYTHON-PYJWT-17053408...

DEBIAN-CVE-2026-48525

PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option "b64": false, RFC 7797, PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For...

PYSEC-0000-CVE-2026-48523

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature...

PYSEC-2026-175

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no...

DEBIAN-CVE-2026-48523

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature...

AZL-93042 CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1

PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option "b64": false, RFC 7797, PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For...

AZL-93036 CVE-2026-48522 affecting package python-jwt for versions less than 2.13.0-1

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no...

CVE-2026-48523

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature...

atlassian-jwt-auth (1.0.9), eve-auth-jwt (>=1.0.2, <=1.0.5) potentially affected by CVE-2026-48524 via pyjwt (1.3.0)

pyjwt PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth 1.0.9 - eve-auth-jwt =1.0.2, =1.0.5 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

PYSEC-2026-176

PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-48524 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-48524 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-48524 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2026-48524 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

django-googleauth-ng (>=2.1.0, <=2.3.0) potentially affected by CVE-2026-48524 via pyjwt (0.4.1)

pyjwt PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-googleauth-ng =2.1.0, =2.3.0 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-48524 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

eve-auth-jwt (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-48524 via pyjwt (1.0.1)

pyjwt PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - eve-auth-jwt =1.0.0, =1.0.1 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...