11 matches found
SUSE CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
Linux Distros Unpatched Vulnerability : CVE-2026-103001
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable...
GHSA-GVP8-978C-RX2Q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...
EUVD-2026-90388
PyJWT.decode reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse...
AZL-105642 CVE-2026-103001 affecting package python-jwt for versions less than 2.15.1-1
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
DEBIAN-CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
UBUNTU-CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...
CVE-2026-103001
The PyJWT library (versions 2.11.0 through 2.13.0 ) contains a vulnerability where the PyJWT._merge_options() method modifies a caller-supplied mutable options mapping when verify_signature is set to false . If an application reuses this same mapping for subsequent decode() or decode_complete() c...
CVE-2026-103001
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...