pyjwt (PyPI)
Advisories
48
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.15.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "pyjwt>=2.15.0"poetry
poetry add "pyjwt>=2.15.0"uv
uv add "pyjwt>=2.15.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pxh4-856f-4h89 PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery |
High | < 2.14.0 | 2.14.0 |
| GHSA-gvp8-978c-rx2q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse |
Medium EPSS 0.26% |
>= 2.11.0, <= 2.13.0 | No fix yet |
| GHSA-gvp8-978c-rx2q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse |
Medium EPSS 0.26% |
>= 2.11.0, <= 2.13.0 | No fix yet |
| GHSA-x33g-cr3x-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion |
High EPSS 0.17% |
>= 2.1.0, < 2.15.0 | 2.15.0 |
| GHSA-x33g-cr3x-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion |
High EPSS 0.17% |
>= 2.1.0, < 2.15.0 | 2.15.0 |
| GHSA-w6j9-cwv2-h6wq PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set |
High EPSS 0.55% |
>= 2.9.0, < 2.14.0 | 2.14.0 |
| GHSA-w6j9-cwv2-h6wq PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set |
High EPSS 0.55% |
>= 2.9.0, < 2.14.0 | 2.14.0 |
| GHSA-w2cx-738m-mc7w PyJWT accepts public JWK containers as HMAC secrets |
High EPSS 0.18% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-w2cx-738m-mc7w PyJWT accepts public JWK containers as HMAC secrets |
High EPSS 0.18% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-r6x4-923q-g947 PyJWT BOM Bypass |
High EPSS 0.22% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-r6x4-923q-g947 PyJWT BOM Bypass |
High EPSS 0.22% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-p4g4-x82p-q773 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard |
High EPSS 0.21% |
>= 2.4.0, < 2.14.0 | 2.14.0 |
| GHSA-p4g4-x82p-q773 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard |
High EPSS 0.21% |
>= 2.4.0, < 2.14.0 | 2.14.0 |
| GHSA-jwrc-g2q2-pq5p PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. |
Medium EPSS 0.25% |
< 2.14.0 | 2.14.0 |
| GHSA-jwrc-g2q2-pq5p PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. |
Medium EPSS 0.25% |
< 2.14.0 | 2.14.0 |
| GHSA-hxm8-2xgr-2p9m PyJWT: Non-canonical signature segments enable raw-token revocation bypass |
Medium EPSS 0.22% |
< 2.14.0 | 2.14.0 |
| GHSA-hxm8-2xgr-2p9m PyJWT: Non-canonical signature segments enable raw-token revocation bypass |
Medium EPSS 0.22% |
< 2.14.0 | 2.14.0 |
| GHSA-ffc3-869f-jxw9 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard |
Critical EPSS 0.24% |
< 2.14.0 | 2.14.0 |
| GHSA-ffc3-869f-jxw9 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard |
Critical EPSS 0.24% |
< 2.14.0 | 2.14.0 |
| GHSA-9v7f-9g4p-ffgj PyJWT: PyJWKClient follows redirects when fetching JWKS |
Critical EPSS 0.16% |
< 2.14.0 | 2.14.0 |
| GHSA-9v7f-9g4p-ffgj PyJWT: PyJWKClient follows redirects when fetching JWKS |
Critical EPSS 0.16% |
< 2.14.0 | 2.14.0 |
| GHSA-9j54-fg26-wv3r PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation |
Critical EPSS 0.22% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-9j54-fg26-wv3r PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation |
Critical EPSS 0.22% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-8wjv-2p76-3863 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header |
Medium EPSS 0.34% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-8wjv-2p76-3863 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header |
Medium EPSS 0.34% |
>= 2.13.0, < 2.14.0 | 2.14.0 |
| GHSA-42vr-xj54-vc7v PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) |
High EPSS 0.41% |
>= 2.0.0a1, < 2.15.0 | 2.15.0 |
| GHSA-42vr-xj54-vc7v PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) |
High EPSS 0.41% |
>= 2.0.0a1, < 2.15.0 | 2.15.0 |
| GHSA-2gx3-rcp4-g85q PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) |
High EPSS 0.43% |
< 2.14.0 | 2.14.0 |
| GHSA-2gx3-rcp4-g85q PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) |
High EPSS 0.43% |
< 2.14.0 | 2.14.0 |
| GHSA-xgmm-8j9v-c9wx PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed |
High EPSS 0.43% |
< 2.13.0 | 2.13.0 |
| GHSA-xgmm-8j9v-c9wx PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed |
High EPSS 0.43% |
< 2.13.0 | 2.13.0 |
| GHSA-w7vc-732c-9m39 PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS |
Medium EPSS 0.37% |
>= 2.8.0, < 2.13.0 | 2.13.0 |
| GHSA-w7vc-732c-9m39 PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS |
Medium EPSS 0.37% |
>= 2.8.0, < 2.13.0 | 2.13.0 |
| GHSA-fhv5-28vv-h8m8 PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) |
Low EPSS 0.40% |
< 2.13.0 | 2.13.0 |
| GHSA-fhv5-28vv-h8m8 PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) |
Low EPSS 0.40% |
>= 2.0.0, < 2.13.0 | 2.13.0 |
| GHSA-jq35-7prp-9v3f PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys |
Medium EPSS 0.13% |
>= 2.9.0, < 2.13.0 | 2.13.0 |
| GHSA-jq35-7prp-9v3f PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys |
Medium EPSS 0.13% |
>= 2.9.0, < 2.12.1 | 2.12.1 |
| GHSA-993g-76c3-p5m4 PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes |
Medium EPSS 0.22% |
>= 2.0.0, < 2.13.0 | 2.13.0 |
| GHSA-993g-76c3-p5m4 PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes |
Medium EPSS 0.22% |
< 2.13.0 | 2.13.0 |
| GHSA-752w-5fwx-jx9f PyJWT accepts unknown `crit` header extensions |
High EPSS 0.28% |
< 2.12.0 | 2.12.0 |
| GHSA-752w-5fwx-jx9f PyJWT accepts unknown `crit` header extensions |
High EPSS 0.28% |
< 2.12.0 | 2.12.0 |
| PYSEC-2025-183 pyjwt v2.10.1 was discovered to contain weak encryption. |
High EPSS 0.18% |
<= 2.10.1 | No fix yet |
| GHSA-75c5-xw7c-p5pm PyJWT Issuer field partial matches allowed |
High EPSS 0.83% |
>= 2.10.0, < 2.10.1 | 2.10.1 |
| GHSA-75c5-xw7c-p5pm PyJWT Issuer field partial matches allowed |
High EPSS 0.83% |
>= 2.10.0, < 2.10.1 | 2.10.1 |
| GHSA-ffqj-6fqr-9h24 Key confusion through non-blocklisted public key formats |
High EPSS 1.35% |
>= 1.5.0, < 2.4.0 | 2.4.0 |
| GHSA-ffqj-6fqr-9h24 Key confusion through non-blocklisted public key formats |
High EPSS 1.35% |
>= 1.5.0, < 2.4.0 | 2.4.0 |
| GHSA-r9jw-mwhq-wp62 PyJWT vulnerable to key confusion attacks |
High EPSS 1.80% |
< 1.5.1 | 1.5.1 |
| GHSA-r9jw-mwhq-wp62 PyJWT vulnerable to key confusion attacks |
High EPSS 1.80% |
< 1.5.1 | 1.5.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor