Homepage

PyJWT@2.14.0

JSON Web Token implementation in Python

  • latest version

    2.15.1

  • latest non vulnerable version

    2.15.1

  • first published

    15 years ago

  • latest version published

    19 days ago

  • licenses detected

  • View PyJWT package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the PyJWT package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Uncaught Exception

    PyJWT is a Python implementation of RFC 7519.

    Affected versions of this package are vulnerable to Uncaught Exception via _decode_payload in jwt/api_jwt.py, where a JWT token containing a deeply nested JSON payload triggers an unhandled RecursionError during json.loads parsing. An attacker can crash the application by submitting a token whose payload is a recursively nested JSON structure, causing an uncaught exception that propagates out of the decode path.

    How to fix Uncaught Exception?

    Upgrade PyJWT to version 2.15.0 or higher.

    [2.0.0a1,2.15.0)
    • H
    Improper Verification of Cryptographic Signature

    PyJWT is a Python implementation of RFC 7519.

    Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the from_jwk function in jwt/algorithms.py when loading an OKP (Octet Key Pair) private key from a JWK. The function constructs the private key from the d parameter without verifying that the supplied public key component x matches the public key derived from d, allowing an attacker to supply a JWK where the private and public key components are inconsistent. This mismatch can be exploited to bypass signature verification, as the public key used for verification does not correspond to the private key used for signing.

    How to fix Improper Verification of Cryptographic Signature?

    Upgrade PyJWT to version 2.15.0 or higher.

    [2.1.0,2.15.0)
    Go back to all versions of this package