PT-2026-102364

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description An issue exists in the HMACAlgorithm.prepare key function within jwt/algorithms.py where the raw-JWK detector fails to normalize Unicode byte-order marks BOM before JSON validation. When a publi...

CVE-2026-103001

creationtimestamp| type| source ---|---|--- 2026-09-08 20:06:01+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q 2026-10-01 03:30:31+00:00| seen| https://gist.github.com/alon710/ae5f872dc1573f4f9211b4ab5e48215f 2026-10-05 14:39:10+00:00|...

PT-2026-103622

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.11.0 through 2.13.0 Description The PyJWT. merge options function can modify a mutable options mapping provided by the caller when verify signature is set to false. If an application reuses this modified mapping in subsequent...

PT-2026-102366

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.9.0 through 2.13.x Description PyJWT fails to handle a ValueError triggered by the RSAAlgorithm.from jwk function in jwt/api jwk.py when processing malformed RSA JSON Web Key JWK components. If a JWK Set contains a single...

NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)

The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch4 Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen whic...

CLSA-2026-1787038724 TuxCare security update for pyjwt (3 CVEs)

TuxCare rebuilt pyjwt to address 3 CVEs. Fixed in 1.7.1.post3+tuxcare...

CLSA-2026-1787028607 TuxCare security update for pyjwt (1 CVE)

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.3.0.post3+tuxcare...

Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-2051)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2051 advisory. PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector...

CLSA-2026-1786944250 TuxCare security update for pyjwt (2 CVEs)

TuxCare rebuilt pyjwt to address 2 CVEs. Fixed in 2.8.0.post3+tuxcare...

CLSA-2026-1786522025 TuxCare security update for pyjwt (1 CVE)

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.10.1.post3+tuxcare...

CLSA-2026-1786521955 TuxCare security update for pyjwt (1 CVE)

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.3.0.post2+tuxcare...

CLSA-2026-1786520090 TuxCare security update for pyjwt (1 CVE)

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.8.0.post2+tuxcare...

PT-2026-80101

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.10.1.post3+tuxcare...

PT-2026-80100

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.3.0.post2+tuxcare...

PT-2026-80097

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.8.0.post2+tuxcare...

EulerOS 2.0 SP11 : python-jwt (EulerOS-SA-2026-3145)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...