alcali (3006.3.0), auth-lib-services (>=0.0.6, <=0.0.7) +45 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (>=5.0.0, <=5.5.0)

djangorestframework-simplejwt PYPI version =5.0.0, =0.0.6, =0.0.8, =0.0.3, =1.0.0, =0.1.7, =0.4.0, =1.0.1, =1.0.0, =1.0.0, =0.2.1, =1.0.0, =0.1.0, =1.0.1, =0.0.86, =0.0.104 and more Source cves: CVE-2024-22513 Source advisory: OSV:PYSEC-2026-1305...

arccanet (>=0.0.1, <=0.0.7), dj-jwt (>=0.0.1, <=0.0.2) +5 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.7.2)

djangorestframework-simplejwt PYPI version 4.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - arccanet =0.0.1, =0.0.1, =0.0.7, =2.0.0, =8.0.0 Source cves: CVE-2024-22513 Source advisory:...

django-restframework-2fa (>=0.0.15, <=0.0.16), los-docusign (0.2.2) +2 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.6.0)

djangorestframework-simplejwt PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - django-restframework-2fa =0.0.15, =0.0.16 - los-docusign 0.2.2 - tea-django 0.0.14 - traktor 0.0.10...

PYSEC-2026-1305 Improper Privilege Management in djangorestframework-simplejwt

djangorestframework-simplejwt before version 5.5.1 is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the foruser method...

auth-satvadev (>=1.0.0, <=1.0.4), django-learngual (>=0.82.0, <=0.895.0) +10 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.8.0)

djangorestframework-simplejwt PYPI version 4.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - auth-satvadev =1.0.0, =0.82.0, =0.2.2, =0.0.1, =1.3.0, =2.0.0b1, =0.1.0, =1.0.0, =1.0.7 Source cves:...

alcali (>=2018.3.1, <=2019.2.2), human-lambdas (>=1.0.43, <=1.0.51) +2 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.3.0)

djangorestframework-simplejwt PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - alcali =2018.3.1, =1.0.43, =0.3.1, =0.3.3 - uboxadmin 0.1.0 Source cves: CVE-2024-22513 Source advisor...

alcali (>=2018.3.3, <=3003.1.0), django-rework (>=0.2.2, <=0.4.6) +1 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.4.0)

djangorestframework-simplejwt PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - alcali =2018.3.3, =0.2.2, =0.0.9, =0.0.13 Source cves: CVE-2024-22513 Source advisory:...

xdj-datamap (>=0.0.1, <=0.0.5), xdj-oauth (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2024-22513 via djangorestframework-simplejwt (4.7.1)

djangorestframework-simplejwt PYPI version 4.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework-simplejwt and may be impacted: - xdj-datamap =0.0.1, =0.0.1, =0.0.3, =0.0.1, =0.0.6 Source cves: CVE-2024-22513 Source advisory:...

SUSE CVE-2026-33204

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

CVE-2026-33204

A flaw was found in SimpleJWT, a PHP library for JSON Web Tokens. An unauthenticated attacker can exploit this vulnerability by tampering with JSON Web Encryption JWE headers when Password-Based Key Derivation Function 2 PBES2 algorithms are in use. This can lead to a Denial of Service DoS if an...

CVE-2026-33204

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

CVE-2026-33204

CVE-2026-33204 affects the PHP library SimpleJWT prior to v1.1.1. An unauthenticated attacker can trigger a Denial of Service by tampering JWE headers when PBES2 algorithms are used, causing excessive PBKDF2 iterations during JWE::decrypt() on attacker-controlled JWEs. The issue is fixed in v1.1....

CVE-2026-33204

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

CVE-2026-33204 SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

CVE-2026-33204 SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

CVE-2026-33204 SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

CVE-2026-33204: Uncontrolled Resource Consumption

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are...

SimpleJWT resource management error vulnerability

SimpleJWT is a JSON Web Token library written in PHP by Kelvin Mo as a personal project. Versions of SimpleJWT prior to 1.1.1 contained a resource management vulnerability. This vulnerability arises from the use of the PBES2 algorithm, allowing unauthenticated attackers to perform denial-of-servi...

PT-2026-26212

Summary An unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt on attacker-controlled JWEs using PBES2 algorithms are affected. Details PHP version: PHP 8.4.11 SimpleJWT version: v1.1.0 The relevant...

Security update for python-djangorestframework-simplejwt (moderate)

openSUSE Security Update: Security update for python-djangorestframework-simplejwt Announcement ID: openSUSE-SU-2025:0425-1 Rating: moderate References: 1221568 Cross-References: CVE-2024-22513 Affected Products: openSUSE Backports SLE-15-SP6 An update that fixes one vulnerability is now availabl...