Product by Jpadilla
Pyjwt
22 known vulnerabilities in Pyjwt (Jpadilla), 0 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2022-29217 | Key confusion through non-blocklisted public key formats in PyJWT | 7.4 | |
| Critical | CVE-2026-102268 | Jpadilla Pyjwt: Improper Verification of Cryptographic Signature | 9.1 | |
| High | CVE-2026-102274 | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set | 5.9 | |
| High | CVE-2026-102272 | PyJWT BOM Bypass | 7.4 | |
| Critical | CVE-2026-102266 | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | 7.4 | |
| High | CVE-2026-102271 | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | 7.4 | |
| High | CVE-2026-102273 | PyJWT accepts public JWK containers as HMAC secrets | 7.4 | |
| Critical | CVE-2026-102267 | PyJWT: PyJWKClient follows redirects when fetching JWKS | 7.4 | |
| High | CVE-2026-101917 | Jpadilla Pyjwt: Allocation of Resources Without Limits or Throttling | 5.3 | |
| High | CVE-2026-48526 | Jpadilla Pyjwt: Improper Verification of Cryptographic Signature | 7.4 | |
| High | CVE-2026-101918 | Jpadilla Pyjwt: Uncaught Exception | 5.3 | |
| Medium | CVE-2026-103001 | Jpadilla Pyjwt: Modification of Assumed-Immutable Data (MAID) | 6.5 | |
| High | CVE-2026-102275 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion | 6.5 | |
| Medium | CVE-2026-102265 | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header | 5.3 | |
| High | CVE-2026-32597 | PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | 7.5 | |
| Medium | CVE-2026-102269 | PyJWT: Non-canonical signature segments enable raw-token revocation bypass | 4.8 | |
| Medium | CVE-2026-102270 | Jpadilla Pyjwt: Inefficient Regular Expression Complexity | 4.4 | |
| Medium | CVE-2026-48525 | Jpadilla Pyjwt: Uncontrolled Resource Consumption | 5.3 | |
| Low | CVE-2026-48524 | PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) | 3.7 | |
| Medium | CVE-2026-48523 | PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys | 5.4 | |
| High | CVE-2024-53861 | Issuer field partial matches allowed in pyjwt | 2.2 | |
| Medium | CVE-2026-48522 | Jpadilla Pyjwt: Server-Side Request Forgery (SSRF) | 4.2 |