Jjpadilla

Products

Exploited and recent CVEs

• CVE-2026-103001 Medium 6.5 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 0.3%
• CVE-2026-102265 Medium 5.3 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header 0.3%
• CVE-2026-102275 Medium 6.5 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion 0.2%
• CVE-2026-102274 Medium 5.9 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set 0.5%
• CVE-2026-102273 High 7.4 PyJWT accepts public JWK containers as HMAC secrets 0.2%
• CVE-2026-102272 High 7.4 PyJWT BOM Bypass 0.2%
• CVE-2026-102271 High 7.4 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 0.2%
• CVE-2026-102270 Medium 4.4 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. 0.2%
• CVE-2026-102269 Medium 4.8 PyJWT: Non-canonical signature segments enable raw-token revocation bypass 0.2%
• CVE-2026-102268 Critical 9.1 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 0.2%
• CVE-2026-102267 High 7.4 PyJWT: PyJWKClient follows redirects when fetching JWKS 0.2%
• CVE-2026-102266 High 7.4 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation 0.2%
• CVE-2026-101918 Medium 5.3 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 0.4%
• CVE-2026-101917 Medium 5.3 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) 0.4%
• CVE-2026-48525 Medium 5.3 PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS 0.4%
• CVE-2026-48523 Medium 5.4 PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys 0.1%
• CVE-2026-48526 High 7.4 PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed 0.4%
• CVE-2026-48524 Low 3.7 PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) 0.4%
• CVE-2026-48522 Medium 4.2 PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes 0.2%
• CVE-2026-32597 High 7.5 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) 0.3%
• CVE-2024-53861 Low 2.2 Issuer field partial matches allowed in pyjwt 0.8%
• CVE-2022-29217 High 7.4 Key confusion through non-blocklisted public key formats in PyJWT 1.4%