Jpadilla Pyjwt vulnerabilities

• jpadilla pyjwt PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse CVE-2026-103001 Fix available 6.5 MediumSeptember 30, 2026
• jpadilla pyjwt PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header CVE-2026-102265 Fix available 5.3 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVE-2026-102275 Fix available 6.5 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set CVE-2026-102274 Fix available 5.9 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT accepts public JWK containers as HMAC secrets CVE-2026-102273 Fix available 7.4 HighSeptember 28, 2026
• jpadilla pyjwt PyJWT BOM Bypass CVE-2026-102272 Fix available 7.4 HighSeptember 28, 2026
• jpadilla pyjwt PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard CVE-2026-102271 Fix available 7.4 HighSeptember 28, 2026
• jpadilla pyjwt PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. CVE-2026-102270 Fix available 4.4 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT: Non-canonical signature segments enable raw-token revocation bypass CVE-2026-102269 Fix available 4.8 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard CVE-2026-102268 Public exploitFix available 9.1 CriticalSeptember 28, 2026
• jpadilla pyjwt PyJWT: PyJWKClient follows redirects when fetching JWKS CVE-2026-102267 Fix available 7.4 HighSeptember 28, 2026
• jpadilla pyjwt PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVE-2026-102266 Fix available 7.4 HighSeptember 28, 2026
• jpadilla pyjwt PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) CVE-2026-101918 Fix available 5.3 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVE-2026-101917 Fix available 5.3 MediumSeptember 28, 2026
• jpadilla pyjwt PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS CVE-2026-48525 Fix available 5.3 MediumMay 28, 2026
• jpadilla pyjwt PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys CVE-2026-48523 Fix available 5.4 MediumMay 28, 2026
• jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 more PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed CVE-2026-48526 Fix available 7.4 HighMay 28, 2026
• jpadilla pyjwt PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) CVE-2026-48524 Fix available 3.7 LowMay 28, 2026
• jpadilla pyjwt PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes CVE-2026-48522 Fix available 4.2 MediumMay 28, 2026
• jpadilla pyjwt, red hat openshift lightspeed, ai inference server +27 more +29 more PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVE-2026-32597 Fix available 7.5 HighMarch 12, 2026
• jpadilla pyjwt Issuer field partial matches allowed in pyjwt CVE-2024-53861 Fix available 2.2 LowNovember 29, 2024
• jpadilla pyjwt, fedoraproject fedora +1 more Key confusion through non-blocklisted public key formats in PyJWT CVE-2022-29217 Fix available 7.4 HighMay 24, 2022