PyJWT is a widely embedded Python library for JSON Web Token encoding and decoding that sits deep in the software supply chain across web applications and API services, despite its narrow product scope. Its vulnerability profile centers on cryptographic-signature verification, authentication handling, and exception-management weaknesses that reflect the parsing and state-machine complexity inherent to JWT processing, where subtle flaws in token validation can propagate across dependent applications. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pyjwt Project over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-48526HIGH PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the librar | May 28, 2026 | 7.4 | 35 | NO | NO |
CVE-2026-32597HIGH PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token cont | Mar 13, 2026 | 7.5 | 30 | NO | NO |
CVE-2026-48523MEDIUM PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called | May 28, 2026 | 5.4 | 26 | NO | NO |
CVE-2026-48525MEDIUM PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT perf | May 28, 2026 | 5.3 | 25 | NO | NO |
CVE-2022-29217HIGH PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing a | May 24, 2022 | 7.5 | 25 | NO | NO |
CVE-2025-45768HIGH pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedl | Jul 31, 2025 | 7.0 | 24 | NO | NO |
CVE-2017-11424HIGH In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format wou | Aug 24, 2017 | 7.5 | 24 | NO | NO |
CVE-2026-48522MEDIUM PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default Ope | May 28, 2026 | 4.2 | 23 | NO | NO |
CVE-2024-53861HIGH pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug intro | Nov 29, 2024 | 7.5 | 22 | NO | NO |
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown ki | May 28, 2026 | 3.7 | 21 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pyjwt Project.
Media articles that mention a CVE ID that affects a product developed by Pyjwt Project — matched by CVE ID, not by vendor name.