Skip to content
OpenAdvisories

Package · Debian

pyjwt

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-48524

    PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token heade…

    jpadilla pyjwt pyjwt pyjwt Debian Ubuntu PyPI