python-PyJWT vulnerabilities (SUSE)
24 vulnerabilities.
-
python-PyJWTSUSE PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 6.5 Medium -
python-PyJWTSUSE PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion 6.5 Medium -
python-PyJWTSUSE PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set 5.9 Medium -
python-PyJWTSUSE PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 7.4 High -
python-PyJWTSUSE PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. 4.4 Medium -
python-PyJWTSUSE PyJWT: Non-canonical signature segments enable raw-token revocation bypass 4.8 Medium -
python-PyJWTSUSE PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 9.1 Critical -
python-PyJWTSUSE PyJWT: PyJWKClient follows redirects when fetching JWKS 7.4 High -
python-PyJWTSUSE PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 5.3 Medium -
python-PyJWTSUSE PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) 5.3 Medium -
python-PyJWTSUSE PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS 5.3 Medium -
python-PyJWTSUSE PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys 5.4 Medium -
python-PyJWTSUSE PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed 7.4 High -
python-PyJWTSUSE PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) 3.7 Low -
python-PyJWTSUSE PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes 4.2 Medium -
python-PyJWTSUSE PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) 7.5 High -
python-PyJWTSUSE Issuer field partial matches allowed in pyjwt 2.2 Low -
python-PyJWTSUSE redis-py Race Condition due to incomplete fix 6.5 Medium -
python-PyJWTSUSE redis-py Race Condition vulnerability 3.7 Low -
python-PyJWTSUSE Key confusion through non-blocklisted public key formats in PyJWT 7.4 High -
python-PyJWTSUSE Improper Input Validation in PyYAML 9.8 Critical -
python-PyJWTSUSE RSA decryption vulnerable to Bleichenbacher timing vulnerability 5.9 Medium -
python-PyJWTSUSE Security update for python-PyJWT No score -
python-PyJWTSUSE Urllib3 Incorrect Certificate Validation 3.7 Low