py3-jwt vulnerabilities (Alpaquita)
20 vulnerabilities.
py3-jwtAlpaquitaPyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse6.5 Mediumpy3-jwtAlpaquitaPyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header5.3 Mediumpy3-jwtAlpaquitaPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion6.5 Mediumpy3-jwtAlpaquitaPyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set5.9 Mediumpy3-jwtAlpaquitaPyJWT accepts public JWK containers as HMAC secrets7.4 Highpy3-jwtAlpaquitaPyJWT BOM Bypass7.4 Highpy3-jwtAlpaquitaPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard7.4 Highpy3-jwtAlpaquitaPyJWT: ReDoS vulnerability when calling the `is_pem_format` function.4.4 Mediumpy3-jwtAlpaquitaPyJWT: Non-canonical signature segments enable raw-token revocation bypass4.8 Mediumpy3-jwtAlpaquitaPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard9.1 Criticalpy3-jwtAlpaquitaPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 Highpy3-jwtAlpaquitaPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation7.4 Highpy3-jwtAlpaquitaPyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)5.3 Mediumpy3-jwtAlpaquitaPyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)5.3 Mediumpy3-jwtAlpaquitaPyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS5.3 Mediumpy3-jwtAlpaquitaPyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys5.4 Mediumpy3-jwtAlpaquitaPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 Highpy3-jwtAlpaquitaPyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)3.7 Lowpy3-jwtAlpaquitaPyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes4.2 Mediumpy3-jwtAlpaquitaPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 High