CVE-2024-53861Low· 2.2▾ SunlitA flaw was found in the pyJWT package. An incorrect string comparison is run for `iss` checking, which allows for partial matches. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.8%
0.8% → 0.8%
Last analysed / modified upstream
A flaw was found in the pyJWT package. An incorrect string comparison is run for iss checking, which allows for partial matches. This results in if "abc" not in "__abcd__": being checked instead of if "abc" != "__abc__":. Signature checks are still present so real world impact is likely limited to denial of service scenarios.
pyjwt: Issuer field partial matches allowed in pyjwt — rated Low by Red Hat. Released 2024-11-29, updated 2026-10-14.
Not affected:
Refer to the advisory for fix availability.
Affected packages:
pyjwt >= 2.10.0, < 2.10.1Patched in:
pyjwt 2.10.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103001Medium· 6.5PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102273High· 7.4PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102274Medium· 5.9PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102275Medium· 6.5PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102270Medium· 4.4PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-102271High· 7.4PyJWT is a Python implementation of JSON Web Token standards