python-jwt vulnerabilities (openEuler)
10 vulnerabilities.
-
python-jwtopenEuler PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header 5.3 Medium -
python-jwtopenEuler PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion 6.5 Medium -
python-jwtopenEuler PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 7.4 High -
python-jwtopenEuler PyJWT: Non-canonical signature segments enable raw-token revocation bypass 4.8 Medium -
python-jwtopenEuler PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 9.1 Critical -
python-jwtopenEuler PyJWT: PyJWKClient follows redirects when fetching JWKS 7.4 High -
python-jwtopenEuler PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 5.3 Medium -
python-jwtopenEuler PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) 5.3 Medium -
python-jwtopenEuler PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) 7.5 High -
python-jwtopenEuler Key confusion through non-blocklisted public key formats in PyJWT 7.4 High