{"id":"CVE-2024-53861","title":"pyjwt: Issuer field partial matches allowed in pyjwt (CVE-2024-53861)","summary":"A flaw was found in the pyJWT package. An incorrect string comparison is run for `iss` checking, which allows for partial matches. This results in `if \"abc\" not in \"__abcd__\":` being checked instead of `if \"abc\" != \"__abc__\":`. Signature c…","severity":"low","cvss":2.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-697","vendor":"Red Hat","product":"pyjwt","affected":["pyjwt >= 2.10.0, < 2.10.1"],"patched":["pyjwt 2.10.1"],"published":"2024-11-29","updated":"2026-10-14","sourceUpdated":"2026-10-14T05:06:59+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53861.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53861.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-53861"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329527"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53861"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53861"},{"url":"https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366"},{"url":"https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1"},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm"},{"url":"https://github.com/jpadilla/pyjwt"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00832,"epssPercentile":0.57413,"aliases":["GHSA-75c5-xw7c-p5pm","PYSEC-2026-1814"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:46.765Z","slug":"CVE-2024-53861","body":"## Overview\n\nA flaw was found in the pyJWT package. An incorrect string comparison is run for `iss` checking, which allows for partial matches. This results in `if \"abc\" not in \"__abcd__\":` being checked instead of `if \"abc\" != \"__abc__\":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53861.json)\n\n**pyjwt: Issuer field partial matches allowed in pyjwt** — rated Low by Red Hat. Released 2024-11-29, updated 2026-10-14.\n\nNot affected:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 1.2\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Update Infrastructure 4 for Cloud Providers\n\n## Remediation\n\nRefer to the advisory for fix availability.\n\n## Package advisory (CVE-2024-53861)\n\nAffected packages:\n\n- `pyjwt >= 2.10.0, < 2.10.1`\n\nPatched in:\n\n- `pyjwt 2.10.1`\n\nSource: https://osv.dev/vulnerability/GHSA-75c5-xw7c-p5pm","depth":"sunlit","depthScore":12,"depthScoreParts":{"impact":12.1,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}