73 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-jwt (UTSA-2026-054077)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054077 advisory. PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the...
cve-2022-39227-jwt-auth-bypass-demo
CVE-2022-39227 JWT Authentication Bypass Demo Project Goal This project demonstrates the CVE-2022-39227 vulnerability in a controlled local lab environment. This vulnerability affects the python-jwt library versions 3.3.4 and allows an attacker to forge JWT claims without knowing the secret key b...
CVE-2022-39227
CVE-2022-39227 CVE-2022-39227 : Proof of Concept Proof of concept for the CVE-2022-39227. According to this CVE, there is a flaw in the JSON Web Token verification. It is possible with a valid token to re-use its signature with modified claims. Required: 1. A valid JSON Web Token. 2. The backend...
EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3761)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
Medium: python-jwt
Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is...
EulerOS 2.0 SP11 : python-jwt (EulerOS-SA-2026-3091)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...
CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-32597 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-32597 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-48522 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48522 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-48526 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48526 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-48524 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48524 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
...
EulerOS 2.0 SP12 : python-jwt (EulerOS-SA-2026-2617)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
Important: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments...
Security update for python-PyJWT
This update for python-PyJWT fixes the following issues CVE-2026-48522: PyJWKClient passes URI arguments directly to urllib.request.urlopen and allows for SSRF and token forgery bsc1266798. CVE-2026-48523: verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called...
Important: python-jwt
Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer publi...
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...
