PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-azure-armUpgrade fence-agents-kubevirtUpgrade fence-agents-ibmbladeUpgrade fence-agents-gceUpgrade fence-agents-ilo-sshUpgrade fence-agents-lparUpgrade fence-agents-aliyunUpgrade fence-agents-redfishUpgrade fence-agents-apcUpgrade fence-agents-ipmilanUpgrade fence-agents-allUpgrade ha-cloud-supportUpgrade fence-agents-ipduUpgrade fence-agents-intelmodularUpgrade fence-virtd-tcpUpgrade fence-agents-ilo-mpUpgrade fence-virtUpgrade fence-agents-awsUpgrade fence-agents-vmware-soapUpgrade fence-virtd-serialUpgrade fence-agents-brocadeUpgrade fence-agents-scsiUpgrade fence-agents-openstackUpgrade fence-agents-wtiUpgrade fence-virtd-libvirtUpgrade fence-agents-heuristics-pingUpgrade fence-virtd-multicastUpgrade fence-agents-rsaUpgrade fence-agents-bladecenterUpgrade fence-agents-emersonUpgrade fence-agents-computeUpgrade fence-agents-apc-snmpUpgrade fence-agents-sbdUpgrade fence-agents-ifmibUpgrade fence-agents-commonUpgrade fence-virtdUpgrade fence-agents-eaton-snmpUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ibm-powervsUpgrade fence-agents-rhevmUpgrade fence-agents-virshUpgrade fence-agents-cisco-ucsUpgrade fence-agents-amt-wsUpgrade fence-agents-ilo2Upgrade fence-agents-cisco-mdsUpgrade fence-agents-vmware-restUpgrade fence-agents-drac5Upgrade fence-agents-zvmUpgrade fence-agents-rsbUpgrade fence-agents-hpbladeUpgrade fence-virtd-cpgUpgrade fence-agents-kdumpUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-mpathUpgrade fence-agents-epsUpgrade fence-agents-ibm-vpc | Jul 2, 2026 | Jun 16, 2026 |
| Redhat_linux | — | Upgrade fence-agents-epsUpgrade fence-agents-ibm-powervsUpgrade fence-agents-amt-wsUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-emersonUpgrade fence-agents-virshUpgrade fence-virtdUpgrade fence-agents-computeUpgrade fence-agents-redfishUpgrade fence-agents-apc-snmpUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtd-cpgUpgrade fence-agents-rsaUpgrade fence-agents-commonUpgrade fence-agents-drac5Upgrade fence-agents-nutanix-ahvUpgrade fence-agents-rsbUpgrade fence-virtd-debuginfoUpgrade fence-agents-eaton-snmpUpgrade fence-agents-mpathUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-ucsUpgrade fence-agents-ifmibUpgrade fence-agents-openstackUpgrade fence-agents-common-debuginfoUpgrade fence-agents-lparUpgrade fence-agents-kdumpUpgrade fence-agents-ilo2Upgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-awsUpgrade fence-agents-ibm-vpcUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-wtiUpgrade fence-agents-debugsourceUpgrade ha-cloud-support-debuginfoUpgrade fence-virt-debuginfoUpgrade fence-agents-vmware-soapUpgrade fence-agents-rhevmUpgrade fence-agents-kubevirtUpgrade fence-agents-apcUpgrade fence-virtUpgrade fence-agents-ilo-mpUpgrade fence-agents-ilo-sshUpgrade fence-agents-ipmilanUpgrade fence-agents-allUpgrade fence-agents-aliyunUpgrade fence-agents-ibmbladeUpgrade fence-agents-hpbladeUpgrade fence-agents-gceUpgrade fence-agents-debuginfoUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-serialUpgrade fence-agents-scsiUpgrade fence-agents-intelmodularUpgrade fence-agents-brocadeUpgrade fence-agents-sbdUpgrade fence-agents-cisco-mdsUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-vmware-restUpgrade fence-agents-azure-armUpgrade fence-virtd-multicastUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ipduUpgrade fence-virtd-libvirtUpgrade fence-agents-zvmUpgrade fence-agents-bladecenterUpgrade ha-cloud-support | Jun 17, 2026 | May 28, 2026 |
| Rocky_linux | — | Upgrade fence-virtdUpgrade fence-agents-debuginfoUpgrade fence-agents-openstackUpgrade fence-virtd-libvirtUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-computeUpgrade fence-virtUpgrade fence-agents-aliyunUpgrade fence-agents-debugsourceUpgrade fence-agents-common-debuginfoUpgrade fence-virtd-serialUpgrade fence-agents-gceUpgrade fence-agents-kubevirtUpgrade fence-agents-kdump-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-allUpgrade fence-agents-awsUpgrade fence-virtd-multicastUpgrade ha-cloud-supportUpgrade ha-cloud-support-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-virt-debuginfoUpgrade fence-agents-commonUpgrade fence-agents-kdumpUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-azure-armUpgrade fence-virtd-cpg-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-zvmUpgrade fence-agents-redfishUpgrade fence-virtd-cpg | Jun 18, 2026 | Jun 16, 2026 |
| Ubuntu | — | Upgrade python3-jwt (Ubuntu Pro)Upgrade python3-jwtUpgrade python-jwt (Ubuntu Pro) | Sep 28, 2026 | Sep 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub