Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*

2 briefs RSS
critical advisory

PyJWT Asymmetric-PEM Detection Bypass Leading to Algorithm Confusion

An incomplete asymmetric-key guard in PyJWT (CVE-2026-102268) allows specially formatted public keys to be used as HMAC secrets, enabling universal token forgery when applications misconfigure algorithm allow-lists.

PyJWT +1 jwt authentication-bypass cve-2026-102268 library-vulnerability
1t 2c
medium advisory

PyJWT Improper Handling of Critical Header Extensions (CVE-2026-32597)

The PyJWT library fails to reject unknown 'crit' header extensions as required by RFC 7515, creating a potential bypass vulnerability in JWT integrity and authentication checks.

PyJWT
1t 1c updated