Uncontrolled Recursion

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncontrolled Recursion via the load method in jwt/apijws.py when parsing a JWT with a deeply nested recursive JSON structure in the header. An attacker can supply a JWT whose header contains...

CVE-2026-102275

A flaw was found in PyJWT. When importing an Octet Key Pair OKP private JSON Web Key JWK, the library does not verify that the public key component matches the private key component. In applications that accept private key parameters from proof headers, a remote attacker can exploit this...

CVE-2026-102274

A flaw was found in pyjwt. The library fails to properly handle errors when parsing a JSON Web Key JWK set that contains a malformed RSA key alongside valid keys. A remote attacker can supply or inject a malformed key to abort the processing of the entire key set, resulting in authentication...

CVE-2026-102270

A flaw was found in PyJWT. An attacker can cause a Denial of Service DoS by providing crafted certificate-like input containing repeated start markers without matching end markers. This malformed input triggers excessive regular expression backtracking during validation in the ispemformat functio...

CVE-2026-102269

A flaw was found in PyJWT. When decoding JSON Web Token JWT signature segments, the library accepts characters outside the standard Base64URL encoding format. A remote attacker can exploit this issue by appending extra characters to a valid token signature, creating an alternate token...

CVE-2026-102265

A flaw was found in PyJWT. An unauthenticated remote attacker could trigger a Denial of Service DoS condition by supplying a specially crafted JSON Web Token JWT with deeply nested headers during decoding. Processing these nested structures causes an uncaught recursion error that bypasses standar...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via PyJWKClient.getsigningkey in jwt/jwksclient.py, where an attacker can repeatedly present tokens with unknown key IDs, causing the client to perform an unbounded number of forced...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the verifysignature method in jwt/apijws.py when a PyJWK object is used to verify an HMAC-signed token. In the vulnerable code path,...

Uncaught Exception

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncaught Exception via decodepayload in jwt/apijwt.py, where a JWT token containing a deeply nested JSON payload triggers an unhandled RecursionError during json.loads parsing. An attacker c...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via ispemformat in jwt/utils.py, which previously used a regex PEMRE that accepted PEM formatting variants recognised by the underlying cryptography loader but not explicitly validated by pyjwt...

Incorrect Behavior Order: Validate Before Canonicalize

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the load method in jwt/apijws.py, which accepts non-canonical base64url-encoded JWS segments. Because the library does not verify...

Open Redirect

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Open Redirect via the fetchdata method in jwt/jwksclient.py, which follows HTTP redirects when fetching a JWK Set from a remote URI. An attacker who can influence the JWKS endpoint URL or...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ispemformat in jwt/utils.py, which fails to recognize certain loader-accepted PEM formatting variants as valid PEM. The fix for...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where DER-encoded public keys are accepted as HMAC secrets without rejection. An attacker who...

CVE-2026-102273

A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens JWTs. When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key JWK container...

CVE-2026-102272

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

CVE-2026-102271

A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...

CVE-2026-102267

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

DEBIAN-CVE-2026-102275

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...

DEBIAN-CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...