Skip to content
OpenAdvisories

Package · PyPI

pyjwt

25 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-48524

    PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token heade…

    jpadilla pyjwt kserve-storage-controller superset-6.0 Debian Ubuntu Azure Linux Wolfi PyPI
  • Low 2.2
    CVE-2024-53861

    Issuer field partial matches allowed in pyjwt

    pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issu…

    jpadilla pyjwt az pyjwt Wolfi PyPI