73 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-jwt (UTSA-2026-054077)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054077 advisory. PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the...
cve-2022-39227-jwt-auth-bypass-demo
CVE-2022-39227 JWT 身份验证绕过演示 项目目标 本项目在受控的本地实验室环境中演示 CVE-2022-39227 漏洞。该漏洞影响 python-jwt 库（版本 3.3.4），允许攻击者在不了解密钥的情况下，通过利用 python-jwt 与其依赖 jwcrypto 之间的解析不一致性（JWS 序列化）来伪造 JWT 声明。 技术栈 Python 3.9 Flask （Web 框架） python-jwt 3.3.3 （存在漏洞的版本） python-jwt 3.3.4 （已修复/修补的版本） Docker 和 Docker Compose 项目架构 该项目使用...
CVE-2022-39227
CVE-2022-39227 CVE-2022-39227 : 概念验证 此 CVE-2022-39227 的概念验证代码。根据该CVE，JSON Web Token验证存在缺陷。可以通过有效的令牌，利用其签名与修改后的声明一起使用。 所需条件： 1. 一个有效的JSON Web Token。 2. 后端使用的是版本低于 3.3.4 的 Python 库 "python-jwt"。 为了方便使用，我在一次CTF中编写了一个简单的PoC： root@kitploit: usage: CVE-2022-39227-PoC -h -j TOKEN -i CLAIM Proof of Conce...
EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3761)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
Medium: python-jwt
Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is...
EulerOS 2.0 SP11 : python-jwt (EulerOS-SA-2026-3091)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...
CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-48526 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48526 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-32597 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-32597 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-48522 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48522 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-48524 affecting package python-jwt for versions less than 2.13.0-1
CVE-2026-48524 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...
PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
...
EulerOS 2.0 SP12 : python-jwt (EulerOS-SA-2026-2617)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
Important: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments...
Security update for python-PyJWT
This update for python-PyJWT fixes the following issues CVE-2026-48522: PyJWKClient passes URI arguments directly to urllib.request.urlopen and allows for SSRF and token forgery bsc1266798. CVE-2026-48523: verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called...
Important: python-jwt
Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer publi...
python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...
