jpadilla vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20241
3. 202620

Newest CVEs

• CVE-2026-103001

  PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

  jpadilla · pyjwt

  Medium6.5
• CVE-2026-102265

  PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

  jpadilla · pyjwt

  Medium5.3
• CVE-2026-102275

  PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

  jpadilla · pyjwt

  Medium6.5
• CVE-2026-102274

  PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

  jpadilla · pyjwt

  Medium5.9
• CVE-2026-102273

  PyJWT accepts public JWK containers as HMAC secrets

  jpadilla · pyjwt

  High7.4
• CVE-2026-102272

  PyJWT BOM Bypass

  jpadilla · pyjwt

  High7.4
• CVE-2026-102271

  PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

  jpadilla · pyjwt

  High7.4
• CVE-2026-102270

  PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

  jpadilla · pyjwt

  Medium4.4
• CVE-2026-102269

  PyJWT: Non-canonical signature segments enable raw-token revocation bypass

  jpadilla · pyjwt

  Medium4.8
• CVE-2026-102268

  PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

  jpadilla · pyjwt

  Critical9.1