Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/09/30 11:53 p.m.•35 views

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

6.5CVSS6.3AI score0.00241EPSS
SaveExploits1References3Affected Software1
Rows per page
Query Builder