Pyjwt vulnerabilities

2 known vulnerabilities in Pyjwt from Pyjwt Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  Pyjwt: Missing Encryption of Sensitive Data

  CVE-2025-45768Jul 31, 2025Pyjwt Project

  pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in

• 7.5 High severity

  pyjwt: Incorrect Comparison

  CVE-2024-53861Nov 29, 2024Jpadilla

  pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issue