HIGH7.5PyPI
GHSA-752w-5fwx-jx9f· CVE-2026-32597, PYSEC-2026-120PyJWT accepts unknown `crit` header extensions
Modified: 9/10/2026
package
PyPI/pyjwt
pkg:pypi/pyjwt
LOW2.2PyPI
GHSA-75c5-xw7c-p5pm· CVE-2024-53861, PYSEC-2026-1814PyJWT Issuer field partial matches allowed
Modified: 9/10/2026
MEDIUM4.2PyPI
GHSA-993g-76c3-p5m4· CVE-2026-48522, PYSEC-2026-175PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
Modified: 9/10/2026
HIGH7.4PyPI
GHSA-ffqj-6fqr-9h24· CVE-2022-29217, PYSEC-2022-202Key confusion through non-blocklisted public key formats
Modified: 10/15/2024
LOW3.7PyPI
GHSA-fhv5-28vv-h8m8· CVE-2026-48524, PYSEC-2026-177PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-jq35-7prp-9v3f· CVE-2026-48523, PYSEC-2026-176PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-r9jw-mwhq-wp62· CVE-2017-11424, PYSEC-2017-24PyJWT vulnerable to key confusion attacks
Modified: 12/5/2024
MEDIUM5.3PyPI
GHSA-w7vc-732c-9m39· CVE-2026-48525, PYSEC-2026-178PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
Modified: 9/10/2026
HIGH7.4PyPI
GHSA-xgmm-8j9v-c9wx· CVE-2026-48526, PYSEC-2026-179PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Modified: 9/10/2026
—PyPI
PYSEC-2017-24· CVE-2017-11424, GHSA-r9jw-mwhq-wp62Modified: 11/8/2023
—PyPI
PYSEC-2022-202· CVE-2022-29217, GHSA-ffqj-6fqr-9h24Modified: 11/8/2023
HIGH7.0PyPI
PYSEC-2025-183· CVE-2025-45768Modified: 5/21/2026
HIGH7.5PyPI
PYSEC-2026-120· CVE-2026-32597, GHSA-752w-5fwx-jx9fModified: 5/20/2026
MEDIUM4.2PyPI
PYSEC-2026-175· CVE-2026-48522, GHSA-993g-76c3-p5m4Modified: 6/2/2026
MEDIUM5.4PyPI
PYSEC-2026-176· CVE-2026-48523, GHSA-jq35-7prp-9v3fModified: 6/2/2026
LOW3.7PyPI
PYSEC-2026-177· CVE-2026-48524, GHSA-fhv5-28vv-h8m8Modified: 6/2/2026
MEDIUM5.3PyPI
PYSEC-2026-178· CVE-2026-48525, GHSA-w7vc-732c-9m39Modified: 6/2/2026
HIGH7.4PyPI
PYSEC-2026-179· CVE-2026-48526, GHSA-xgmm-8j9v-c9wxModified: 6/2/2026
LOW2.2PyPI
PYSEC-2026-1814· CVE-2024-53861, GHSA-75c5-xw7c-p5pmPyJWT Issuer field partial matches allowed
Modified: 7/7/2026