{"action":"Upgrade jwcrypto to 1.4 or later.","affected":[{"fixed":"1.4","introduced":"0"}],"component":"jwcrypto","cve_ids":["CVE-2022-3102"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.4"],"ghsa_id":"GHSA-gwp4-mcv4-w95j","id":"tcs_01M5KHDSWWYKGZEAQX8Q8D0VS0","modified_at":"2026-07-07T11:46:04.489973883Z","published_at":"2026-07-07T10:17:22.132850Z","references":["https://osv.dev/vulnerability/PYSEC-2026-827","https://github.com/latchset/jwcrypto/security/advisories/GHSA-gwp4-mcv4-w95j","https://github.com/latchset/jwcrypto/commit/f4e912f83cb578e2cd47f8a9398bf15f680bf558","https://github.com/latchset/jwcrypto","https://github.com/latchset/jwcrypto/releases/tag/v1.4.0","https://pypi.org/project/jwcrypto","https://github.com/advisories/GHSA-gwp4-mcv4-w95j","https://nvd.nist.gov/vuln/detail/CVE-2022-3102"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-827","url":"https://osv.dev/vulnerability/PYSEC-2026-827"}],"summary":"jwcrypto token substitution can lead to authentication bypass"}