GHSA-752W-5FWX-JX9F PyJWT accepts unknown `crit` header extensions

Summary PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This is t...

Authentication Bypass

github.com/openpubkey/opkssh is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of JWS structures due to a flaw that allows specially crafted JWS tokens to bypass signature verification logic...