Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

pypi

PyJWT

pypi

JSON Web Token implementation in Python

View on github.com · View on pypi.org

Security Advisories for PyJWT in pypi

Moderate
2 months ago

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS GSA_kwCzR0hTQS13N3ZjLTczMmMtOW0zOc4ABYr0

pypi pyjwt
Moderate
2 months ago

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes GSA_kwCzR0hTQS05OTNnLTc2YzMtcDVtNM4ABYrz

pypi PyJWT
High
2 months ago

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed GSA_kwCzR0hTQS14Z21tLThqOXYtYzl3eM4ABYry

pypi pyjwt
Moderate
2 months ago

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys GSA_kwCzR0hTQS1qcTM1LTdwcnAtOXYzZs4ABYrx

pypi pyjwt
Low
2 months ago

PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) GSA_kwCzR0hTQS1maHY1LTI4dnYtaDhtOM4ABYrb

pypi pyjwt
High
5 months ago

PyJWT accepts unknown `crit` header extensions GSA_kwCzR0hTQS03NTJ3LTVmd3gtang5Zs4ABTlv

pypi PyJWT
Low
over 1 year ago

PyJWT Issuer field partial matches allowed GSA_kwCzR0hTQS03NWM1LXh3N2MtcDVwbc4ABB_Q

pypi PyJWT
High
about 4 years ago

Key confusion through non-blocklisted public key formats GSA_kwCzR0hTQS1mZnFqLTZmcXItOWgyNM4AArBb

pypi pyjwt
High
over 4 years ago

PyJWT vulnerable to key confusion attacks GSA_kwCzR0hTQS1yOWp3LW13aHEtd3A2Ms4AAR9d

pypi pyjwt

Filter by Severity

High 4 Moderate 3 Low 2