CVE-2026-103001
2 advisories.
PyPI/pyjwt CVE-2026-103001: medium 6.5
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.11.0 | - | 2.13.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-gvp8-978c-rx2q
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
- https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35
- https://github.com/jpadilla/pyjwt
CVE-2026-103001 · published · modified · JSON
PyPI/pyjwt CVE-2026-103001: medium 6.5
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.11.0 | - | 2.13.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-4146
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
- https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35
- https://github.com/jpadilla/pyjwt
- https://pypi.org/project/pyjwt
- https://github.com/advisories/GHSA-gvp8-978c-rx2q
- https://nvd.nist.gov/vuln/detail/CVE-2026-103001
CVE-2026-103001 · published · modified · JSON