CVE-2026-101918: Uncaught Exception

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-102266: Improper Verification of Cryptographic Signature

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

PT-2026-102365

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the HMAC key guard only recognizes top-level public JSON Web Key JWK forms and fails to identify container representations. This occurs...

CVE-2026-102273: Improper Verification of Cryptographic Signature

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

USN-8823-1 pyjwt vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

USN-8823-1: PyJWT vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-jwt (UTSA-2026-054077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054077 advisory. PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

SUSE CVE-2026-32597

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

PT-2026-102374

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.1.0 through 2.14.0 Description The OKPAlgorithm.from jwk function in jwt/algorithms.py fails to compare the public key derived from d with x during the private-JWK import process. This occurs when an OKP private JWK provides...

CVE-2026-102270

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:50+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p...

CVE-2026-102266

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:49+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r 2026-09-30 13:30:31+00:00| seen| https://gist.github.com/alon710/021c63a7b1d8134c56a782a255bf9e1a...

CVE-2026-102265

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:22+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863 2026-09-30 14:30:31+00:00| seen| https://gist.github.com/alon710/f6dca5418926a6ce4c4f68d94001f804...

CVE-2026-102271

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:21+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773...

CVE-2026-102272

creationtimestamp| type| source ---|---|--- 2026-09-11 13:35:57+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947...

PT-2026-102363

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.4.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the asymmetric-key guard relies on textual markers that are absent from DER Distinguished Encoding Rules encoding. This occurs when an...

PT-2026-102360

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function in jwt/utils.py fails to recognize all PEM representations accepted by the cryptography loader. This occurs when an application uses both HMAC and asymmetric algorithms and...

PT-2026-102347

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The get signing key from jwt function is affected by a flaw where unknown kid Key ID values trigger forced refreshes of the JSON Web Key Set JWKS without a negative cache or minimum refresh interval...

PT-2026-102373

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The PyJWS. load function in jwt/api jws.py fails to catch RecursionError when processing a deeply nested token header via json.loads. Because the parser only catches ValueError, the RecursionErr...

PT-2026-102364

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description An issue exists in the HMACAlgorithm.prepare key function within jwt/algorithms.py where the raw-JWK detector fails to normalize Unicode byte-order marks BOM before JSON validation. When a publi...