These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
PyJWT incorrectly handles OKP private JWKs with inconsistent public and private keys, potentially allowing unauthorized access token usage in DPoP integrations. This issue arises from the library's acceptance of internally inconsistent OKP private JWKs, where the declared public key 'x' does not match the supplied private key 'd'. The vulnerability affects DPoP integrations, enabling potential unauthorize [truncated]
CVE-2026-48526 is a HIGH severity vulnerability (CVSS 7.4) in PyJWT, a widely-used JSON Web Token implementation for Python. The flaw exists in versions prior to 2.13.0 and stems from improper validation when the library supports both asymmetric (public-key) and HMAC (symmetric) algorithms. Specifically, when decoding JWTs, PyJWT fails to validate the use of JSON Web Keys (JWK) in HMAC algorithm contexts. [truncated]
A denial-of-service vulnerability exists in PyJWT versions 2.8.0 through 2.12.1 when processing detached JSON Web Signature (JWS) tokens with the unencoded-payload option (RFC 7797). The library unnecessarily decodes a Base64URL payload segment from the compact serialization before validating the signature and applying detached-payload rules. This allows unauthenticated remote attackers to force excessive [truncated]
PyJWT versions prior to 2.13.0 contain a denial-of-service vulnerability in the `PyJWKClient.get_signing_key()` method. The method issues a fresh HTTP request to the configured JWKS endpoint whenever it encounters a JWT with an unknown `kid` (key ID) value. Because the `kid` is extracted from the unverified token header, an attacker can craft tokens with arbitrary `kid` values to trigger repeated outbound [truncated]
CVE-2026-48523 is a vulnerability in PyJWT, a JSON Web Token implementation in Python, affecting versions from 2.9.0 to 2.12.1. The issue allows an attacker to bypass the verifier-side algorithm allow-list when using a PyJWK key, potentially leading to signature verification bypass. This vulnerability is fixed in version 2.13.0. The vulnerability impacts systems utilizing PyJWT, particularly those using t [truncated]
PyJWT's PyJWKClient prior to version 2.13.0 accepts arbitrary URI schemes through its uri parameter, which is passed directly to urllib.request.urlopen(). This allows attacker-influenced URLs to trigger unintended protocol handlers including file://, ftp://, and data:// schemes. The vulnerability creates Server-Side Request Forgery (SSRF) conditions where an attacker can read arbitrary local files or caus [truncated]
