EUVD-2026-32917CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
AnalysisAI
Authentication bypass in PyJWT versions prior to 2.13.0 allows remote attackers to forge valid JSON Web Tokens by exploiting an algorithm confusion flaw where the library fails to validate that a JSON Web Key intended for asymmetric verification is not reused as an HMAC shared secret. An attacker who knows the issuer's public key (typically distributed openly via JWKS endpoints) can sign HMAC-algorithm tokens with that public key and have them accepted as legitimate. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Conduct comprehensive inventory of all PyJWT deployments; identify applications using PyJWT versions prior to 2.13.0; document all affected versions and locations. 7 days: No vendor-released patch identified at time of analysis; immediately deploy compensating controls listed below; subscribe to PyJWT security advisories for patch notification. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today