jpadilla

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

jpadilla records in CISA KEV

No jpadilla vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pyjwt 24 records HIGH

Records

24 records

TI-2026-65303 CVE-2026-102268 · GHSA-ffc3-869f-jxw9

Improper signature verification in jpadilla pyjwt

HIGH 80

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00236 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65301 CVE-2026-102266 · GHSA-9j54-fg26-wv3r

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

HIGH 74

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00225 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65219 CVE-2026-101918 · GHSA-42vr-xj54-vc7v

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse…

HIGH 72

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2026-09-28 Partial fix · 2.15.0 CWE-248

TI-2026-65218 CVE-2026-101917 · GHSA-2gx3-rcp4-g85q

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

HIGH 72

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00428 Published 2026-09-28 Partial fix · 2.14.0 CWE-770

TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

HIGH 72

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-03-12 Partial fix · 2.12.0 CWE-345

TI-2026-65310 CVE-2026-102275 · GHSA-x33g-cr3x-6449

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

HIGH 69

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00167 Published 2026-09-28 Partial fix · 2.15.0 CWE-345

TI-2026-65307 CVE-2026-102272 · GHSA-r6x4-923q-g947

PyJWT BOM Bypass

HIGH 68

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00216 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65306 CVE-2026-102271 · GHSA-p4g4-x82p-q773

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

HIGH 68

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00215 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

HIGH 68

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00427 Published 2026-05-28 Partial fix · 2.13.0 CWE-287

TI-2026-65309 CVE-2026-102274 · GHSA-w6j9-cwv2-h6wq

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

HIGH 66

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00549 Published 2026-09-28 Partial fix · 2.14.0 CWE-755

TI-2024-36054 CVE-2024-53861 · GHSA-75c5-xw7c-p5pm

Issuer field partial matches allowed in pyjwt

HIGH 66

pyjwt is a JSON Web Token implementation in Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00832 Published 2024-11-29 Fixed in 2.10.1 CWE-697

TI-2026-65300 CVE-2026-102265 · GHSA-8wjv-2p76-3863

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

MEDIUM 63

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00343 Published 2026-09-28 Partial fix · 2.14.0 CWE-674

TI-2026-35885 CVE-2026-48525 · GHSA-w7vc-732c-9m39

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

MEDIUM 63

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0037 Published 2026-05-28 Partial fix · 2.13.0 CWE-400

TI-2026-65558 CVE-2026-103001 · GHSA-gvp8-978c-rx2q

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

MEDIUM 62

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00257 Published 2026-09-30 Partial fix CWE-471

TI-2026-65304 CVE-2026-102269 · GHSA-hxm8-2xgr-2p9m

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

MEDIUM 58

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00224 Published 2026-09-28 Partial fix · 2.14.0 CWE-180

TI-2026-35883 CVE-2026-48523 · GHSA-jq35-7prp-9v3f

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

MEDIUM 58

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00127 Published 2026-05-28 Partial fix · 2.13.0 CWE-347

TI-2026-65305 CVE-2026-102270 · GHSA-jwrc-g2q2-pq5p

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

MEDIUM 56

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00246 Published 2026-09-28 Partial fix · 2.14.0 CWE-1333

TI-2026-35882 CVE-2026-48522 · GHSA-993g-76c3-p5m4

PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

MEDIUM 53

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00222 Published 2026-05-28 Partial fix · 2.13.0 CWE-441

TI-2026-65302 CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj

PyJWT: PyJWKClient follows redirects when fetching JWKS

MEDIUM 40

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00159 Published 2026-09-28 Partial fix · 2.14.0 CWE-200

TI-2022-11760 CVE-2022-29217 · GHSA-ffqj-6fqr-9h24

Key confusion through non-blocklisted public key formats in PyJWT

LOW 38

PyJWT is a Python implementation of RFC 7519.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01355 Published 2022-05-24 Partial fix · 2.4.0 CWE-327

TI-2017-08451 CVE-2017-11424 · GHSA-r9jw-mwhq-wp62

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does…

LOW 36

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01804 Published 2017-08-24 Partial fix · 1.5.1

TI-2026-65308 CVE-2026-102273 · GHSA-w2cx-738m-mc7w

PyJWT accepts public JWK containers as HMAC secrets

LOW 34

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00175 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2025-28839 CVE-2025-45768 · GHSA-xpf8-484v-j9w6

pyjwt v2.10.1 was discovered to contain weak encryption.

LOW 30

pyjwt v2.10.1 was discovered to contain weak encryption.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00195 Published 2025-07-31 Fixed CWE-311

TI-2026-35884 CVE-2026-48524 · GHSA-fhv5-28vv-h8m8

PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

LOW 18

PyJWT is a JSON Web Token implementation in Python.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.004 Published 2026-05-28 Partial fix · 2.13.0 CWE-460

Open these records in search →