[ Vendor · 14 CVEs ]
jpadilla
CVEs affecting jpadilla published in the last 30 days, plus any jpadilla CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103001 | 30 Sep 2026 | CVSS 6.5 | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reusePyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a… | Fix |
| CVE-2026-102271 | 28 Sep 2026 | CVSS 7.4 | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardPyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because… | Fix |
| CVE-2026-102272 | 28 Sep 2026 | CVSS 7.4 | PyJWT BOM BypassPyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected… | Fix |
| CVE-2026-102273 | 28 Sep 2026 | CVSS 7.4 | PyJWT accepts public JWK containers as HMAC secretsPyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key… | Fix |
| CVE-2026-102274 | 28 Sep 2026 | CVSS 7.5 | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetPyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for… | Fix |
| CVE-2026-102275 | 28 Sep 2026 | CVSS 8.2 | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionPyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected… | Fix |
| CVE-2026-102265 | 28 Sep 2026 | CVSS 5.3 | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerPyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser… | Fix |
| CVE-2026-102266 | 28 Sep 2026 | CVSS 9.1 | PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationPyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification… | Fix |
| CVE-2026-102267 | 28 Sep 2026 | CVSS 9.1 | PyJWT: PyJWKClient follows redirects when fetching JWKSPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not… | Fix |
| CVE-2026-102268 | 28 Sep 2026 | CVSS 9.1 | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does… | Fix |
| CVE-2026-102269 | 28 Sep 2026 | CVSS 5.4 | PyJWT: Non-canonical signature segments enable raw-token revocation bypassPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding… | Fix |
| CVE-2026-102270 | 28 Sep 2026 | CVSS 4.9 | PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression… | Fix |
| CVE-2026-101917 | 28 Sep 2026 | CVSS 7.5 | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses… | Fix |
| CVE-2026-101918 | 28 Sep 2026 | CVSS 7.5 | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected… | Fix |