https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T13:08:50.237453+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2017-11424 CVE-2017-11424 2026-10-02T13:08:53.333082+00:00

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.

 https://vulnerability.circl.lu/vuln/ghsa-r9jw-mwhq-wp62 GHSA-r9jw-mwhq-wp62 — PyJWT vulnerable to key confusion attacks 2026-10-02T13:08:53.333195+00:00

Affected: PyPI: pyjwt

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.

 https://vulnerability.circl.lu/vuln/pysec-2017-24 PYSEC-2017-24 2026-10-02T13:08:53.333248+00:00

Affected: PyPI: pyjwt

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.