pyjwt vulnerabilities (Root)
7 vulnerabilities.
-
pyjwtRoot PyJWT accepts public JWK containers as HMAC secrets 7.4 High -
pyjwtRoot PyJWT BOM Bypass 7.4 High -
pyjwtRoot PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 7.4 High -
pyjwtRoot PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 9.1 Critical -
pyjwtRoot PyJWT: PyJWKClient follows redirects when fetching JWKS 7.4 High -
pyjwtRoot PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation 7.4 High -
pyjwtRoot PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed 7.4 High