Read the docs
TI-2024-36054 Aliases CVE-2024-53861GHSA-75c5-xw7c-p5pm

Issuer field partial matches allowed in pyjwt

Priority HIGH 66CWE-697Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00832 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PyJWT (PyPI): 2.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jpadillapyjwt= 2.10.0—No fix listedCNA
—PyJWT (PyPI)2.10.0 to before 2.10.12.10.1Patch availableGHSA-75c5-xw7c-p5pm
  • pyjwt Vendorjpadilla Affected = 2.10.0 Fixed in — No fix listed CNA
  • PyJWT (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-75c5-xw7c-p5pm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyjwt_project:pyjwt:2.10.0:*:*:*:*:*:*:*2.10.0Vulnerablejpadilla
  • cpe:2.3:a:pyjwt_project:pyjwt:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·jpadilla

Remediation

  • Fix · GHSA-75c5-xw7c-p5pm PyJWT (PyPI) Fixed in 2.10.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 8 products
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53861
  2. 2026-10-03 Alias added: GHSA-75c5-xw7c-p5pm

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2026-65303 Improper signature verification in jpadilla pyjwt CVSS 3.1CRITICAL 9.1
  • TI-2026-65301 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVSS 3.1CRITICAL 9.1
  • TI-2026-65219 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse… CVSS 3.1HIGH 7.5
  • TI-2026-65218 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVSS 3.1HIGH 7.5
  • TI-2026-25107 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVSS 3.1HIGH 7.5
  • TI-2026-65310 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVSS 3.1HIGH 8.2
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences