1 matches found
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...
6.5CVSS6.3AI score0.00241EPSS
SaveExploits1References3Affected Software1
20