{"kind": "product", "path": "vulns/debian-13/pyjwt", "name": "pyjwt", "product": "pyjwt", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-102265", "noindex": false, "published": "2026-09-28T20:48:04.664Z", "modified": "2026-10-01T15:01:31.377Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00301, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102265", "title": "PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863", "https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102275", "noindex": false, "published": "2026-09-28T20:46:33.169Z", "modified": "2026-09-29T13:56:09.869Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "medium", "epss": 0.00143, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102275", "title": "PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449", "https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c", "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102274", "noindex": false, "published": "2026-09-28T20:42:28.355Z", "modified": "2026-09-29T19:38:02.520Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00389, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102274", "title": "PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq", "https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102273", "noindex": false, "published": "2026-09-28T20:38:28.161Z", "modified": "2026-09-29T13:44:49.200Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00175, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102273", "title": "PyJWT accepts public JWK containers as HMAC secrets", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w", "https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102272", "noindex": false, "published": "2026-09-28T20:36:31.530Z", "modified": "2026-09-29T14:45:44.138Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00182, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102272", "title": "PyJWT BOM Bypass", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947", "https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102271", "noindex": false, "published": "2026-09-28T20:31:53.066Z", "modified": "2026-10-01T14:57:42.294Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102271", "title": "PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773", "https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102270", "noindex": false, "published": "2026-09-28T20:29:24.479Z", "modified": "2026-09-29T19:36:54.944Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102270", "title": "PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.", "description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p", "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102269", "noindex": false, "published": "2026-09-28T20:27:54.521Z", "modified": "2026-09-29T13:49:47.562Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00191, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102269", "title": "PyJWT: Non-canonical signature segments enable raw-token revocation bypass", "description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m", "https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102268", "noindex": false, "published": "2026-09-28T20:26:13.674Z", "modified": "2026-09-29T13:59:11.421Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00202, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102268", "title": "PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard", "description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9", "https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102267", "noindex": false, "published": "2026-09-28T20:23:33.556Z", "modified": "2026-10-01T14:56:29.970Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102267", "title": "PyJWT: PyJWKClient follows redirects when fetching JWKS", "description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj", "https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-102266", "noindex": false, "published": "2026-09-28T20:21:26.164Z", "modified": "2026-09-29T19:35:42.049Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00182, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102266", "title": "PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r", "https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-101918", "noindex": false, "published": "2026-09-28T20:11:55.278Z", "modified": "2026-09-29T13:57:29.516Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101918", "title": "PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)", "description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v", "https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b", "https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-101917", "noindex": false, "published": "2026-09-28T20:07:44.237Z", "modified": "2026-09-28T20:35:25.908Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00418, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-101917", "title": "PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)", "description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q", "https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1", "https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-48525", "noindex": false, "published": "2026-05-28T15:11:12.483Z", "modified": "2026-06-23T15:54:09.003Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00415, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48525", "title": "PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS", "description": "PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. T", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39", "https://nvd.nist.gov/vuln/detail/CVE-2026-48525"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-48523", "noindex": false, "published": "2026-05-28T15:10:19.141Z", "modified": "2026-05-28T15:27:49.780Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.0017, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48523", "title": "PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys", "description": "PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f", "https://nvd.nist.gov/vuln/detail/CVE-2026-48523"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-48526", "noindex": false, "published": "2026-05-28T15:09:09.258Z", "modified": "2026-09-10T12:04:52.909Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48526", "title": "PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx", "https://access.redhat.com/security/cve/CVE-2026-48526", "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-48524", "noindex": false, "published": "2026-05-28T15:07:35.162Z", "modified": "2026-05-28T19:17:11.798Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48524", "title": "PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8", "https://nvd.nist.gov/vuln/detail/CVE-2026-48524"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-48522", "noindex": false, "published": "2026-05-28T15:00:30.186Z", "modified": "2026-06-02T15:47:49.649Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48522", "title": "PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4", "https://nvd.nist.gov/vuln/detail/CVE-2026-48522"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-32597", "noindex": false, "published": "2026-03-12T21:41:50.427Z", "modified": "2026-09-10T12:05:06.316Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00273, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32597", "title": "PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.", "references": ["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f", "https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html", "https://access.redhat.com/security/cve/CVE-2026-32597"], "fixes": ["2.10.1-2+deb13u1"], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-45768", "noindex": false, "published": "2025-07-31T00:00:00.000Z", "modified": "2025-08-14T16:01:20.161Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "severity": "high", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-45768", "title": "CVE-2025-45768", "description": "pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).", "references": ["https://github.com/jpadilla", "https://github.com/jpadilla/pyjwt", "https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569"], "fixes": [], "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}]}], "total": 22, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "pyjwt", "path": "vulns/debian-13/pyjwt", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 13, "kev": 0}, "lastmod": "2026-10-01T15:01:31.377Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}