CVE-2026-101918 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918

The PyJWT Python library (versions 2.0.0a1 through 2.15.0 ) is vulnerable to an unhandled RecursionError in the PyJWKClient.get_signing_key_from_jwt function. This occurs because the payload parser catches ValueError but fails to handle RecursionError when processing an attacker-controlled recurs...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted "verifysignature=False" when decoding the ID token, so an attacker able to present a forged or unsigned "alg:none" ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...