{"action":"Upgrade jwcrypto to 1.4 or later.","affected":[{"fixed":"1.4","introduced":"0"}],"component":"jwcrypto","cve_ids":["CVE-2022-3102"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.4"],"ghsa_id":"GHSA-gwp4-mcv4-w95j","id":"tcs_01M5KFJDPQ2E47NPPS1433Z5B1","modified_at":"2026-07-07T11:56:26.608402236Z","published_at":"2022-09-21T16:58:31Z","references":["https://osv.dev/vulnerability/GHSA-gwp4-mcv4-w95j","https://github.com/latchset/jwcrypto/security/advisories/GHSA-gwp4-mcv4-w95j","https://github.com/latchset/jwcrypto/commit/f4e912f83cb578e2cd47f8a9398bf15f680bf558","https://github.com/latchset/jwcrypto","https://github.com/latchset/jwcrypto/releases/tag/v1.4.0"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-gwp4-mcv4-w95j","url":"https://osv.dev/vulnerability/GHSA-gwp4-mcv4-w95j"}],"summary":"jwcrypto token substitution can lead to authentication bypass"}