Vulnerabilidades en jpadilla
22 resultadosCVE-2022-29217HIGHKey confusion through non-blocklisted public key formats in PyJWTEPSS 1.4%CVE-2024-53861LOWIssuer field partial matches allowed in pyjwtEPSS 0.8%CVE-2026-102274MEDIUMPyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetEPSS 0.5%CVE-2026-101917MEDIUMPyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)EPSS 0.4%CVE-2026-48526HIGHPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedEPSS 0.4%CVE-2026-101918MEDIUMPyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)EPSS 0.4%CVE-2026-48524LOWPyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)EPSS 0.4%CVE-2026-48525MEDIUMPyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSEPSS 0.4%CVE-2026-102265MEDIUMPyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerEPSS 0.3%CVE-2026-32597HIGHPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)EPSS 0.3%CVE-2026-103001MEDIUMPyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseEPSS 0.3%CVE-2026-102270MEDIUMPyJWT: ReDoS vulnerability when calling the `is_pem_format` function.EPSS 0.2%CVE-2026-102268CRITICALPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardEPSS 0.2%CVE-2026-102266HIGHPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationEPSS 0.2%CVE-2026-102269MEDIUMPyJWT: Non-canonical signature segments enable raw-token revocation bypassEPSS 0.2%CVE-2026-48522MEDIUMPyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemesEPSS 0.2%CVE-2026-102272HIGHPyJWT BOM BypassEPSS 0.2%CVE-2026-102271HIGHPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardEPSS 0.2%CVE-2026-102273HIGHPyJWT accepts public JWK containers as HMAC secretsEPSS 0.2%CVE-2026-102275MEDIUMPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionEPSS 0.2%