Most recent entries from all

Withdrawn: BELL-CVE-2024-53861 — CVE-2024-53861 does not affect BellSoft software

2026-10-04T21:29:50.583429+00:00

Withdrawn by the publisher.

BREW-bbot-CVE-2024-53861 — PyJWT Issuer field partial matches allowed

2026-10-04T21:29:50.583472+00:00

Affected: Homebrew: bbot

### Summary The wrong string if check is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`.

### Details This is a bug introduced in version [2.10.0](https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366): checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`.

```diff - if isinstance(issuer, list): + if isinstance(issuer, Sequence): if payload["iss"] not in issuer: raise InvalidIssuerError("Invalid issuer") else: ```

Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. ### PoC Check out the unit tests added here: https://github.com/jpadilla/pyjwt-ghsa-75c5-xw7c-p5pm ```python issuer = "urn:expected"

payload = {"iss": "urn:"}

token = jwt.encode(payload, "secret")

# decode() succeeds, even though `"urn:" != "urn:expected". No exception is raised. with pytest.raises(InvalidIssuerError): jwt.decode(token, "secret", issuer=issuer, algorithms=["HS256"]) ```

### Impact

I would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.

EUVD-2026-205339

2026-10-04T21:29:50.583525+00:00

EUVD-2026-205339

fkie_cve-2024-53861

2026-10-04T21:29:50.583547+00:00

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-75c5-xw7c-p5pm — PyJWT Issuer field partial matches allowed

2026-10-04T21:29:50.583577+00:00

Affected: PyPI: PyJWT

### Summary The wrong string if check is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`.

```diff - if isinstance(issuer, list): + if isinstance(issuer, Sequence): if payload["iss"] not in issuer: raise InvalidIssuerError("Invalid issuer") else: ```

payload = {"iss": "urn:"}

token = jwt.encode(payload, "secret")

# decode() succeeds, even though `"urn:" != "urn:expected". No exception is raised. with pytest.raises(InvalidIssuerError): jwt.decode(token, "secret", issuer=issuer, algorithms=["HS256"]) ```

### Impact

I would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.

openSUSE-SU-2024:14540-1 — python310-PyJWT-2.10.1-1.1 on GA media

2026-10-04T21:29:50.583615+00:00

python310-PyJWT-2.10.1-1.1 on GA media

PYSEC-2026-1814 — PyJWT Issuer field partial matches allowed

2026-10-04T21:29:50.583634+00:00

Affected: PyPI: pyjwt

### Summary The wrong string if check is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`.

```diff - if isinstance(issuer, list): + if isinstance(issuer, Sequence): if payload["iss"] not in issuer: raise InvalidIssuerError("Invalid issuer") else: ```

payload = {"iss": "urn:"}

token = jwt.encode(payload, "secret")

# decode() succeeds, even though `"urn:" != "urn:expected". No exception is raised. with pytest.raises(InvalidIssuerError): jwt.decode(token, "secret", issuer=issuer, algorithms=["HS256"]) ```

### Impact

I would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.

SUSE-SU-2026:20879-1 — Security update for python-PyJWT

2026-10-04T21:29:50.583669+00:00

Security update for python-PyJWT

Withdrawn: UBUNTU-CVE-2024-53861

2026-10-04T21:29:50.583685+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: pyjwt, Ubuntu:Pro:18.04:LTS: pyjwt, Ubuntu:20.04:LTS: pyjwt, Ubuntu:22.04:LTS: pyjwt, Ubuntu:24.10: pyjwt, Ubuntu:24.04:LTS: pyjwt