PyJWT vulnerabilities
3 known CVE vulnerabilities in PyJWT, translated and rated.
- CVE-2017-11424High
In PyJWT versions 1.5.0 and below, the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format is allowed, enabling symmetric/asymmetric key confusion attacks.
- CVE-2026-48526High
PyJWT library in Python prior to 2.13.0 does not validate the use of JSON Web Keys in HMAC algorithm, allowing an attacker to use the issuer's public key as the HMAC secret key.
- CVE-2026-32597High
PyJWT before version 2.12.0 does not validate the crit (Critical) Header Parameter defined in RFC 7515. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it, violating the MUST requirement in the RFC.