PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-allUpgrade fence-virtUpgrade fence-virtd-libvirtUpgrade fence-agents-ipmilanUpgrade ha-cloud-supportUpgrade fence-virtd-serialUpgrade fence-agents-brocadeUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ipduUpgrade fence-agents-ibmbladeUpgrade fence-agents-ilo-mpUpgrade fence-agents-vmware-soapUpgrade fence-agents-kubevirtUpgrade fence-agents-openstackUpgrade fence-agents-apcUpgrade fence-agents-scsiUpgrade fence-agents-ilo-sshUpgrade fence-virtd-multicastUpgrade fence-agents-gceUpgrade fence-agents-lparUpgrade fence-agents-wtiUpgrade fence-agents-redfishUpgrade fence-agents-awsUpgrade fence-agents-azure-armUpgrade fence-virtd-tcpUpgrade fence-agents-intelmodularUpgrade fence-agents-aliyunUpgrade fence-virtd-cpgUpgrade fence-agents-commonUpgrade fence-agents-ifmibUpgrade fence-agents-ibm-vpcUpgrade fence-agents-cisco-mdsUpgrade fence-agents-zvmUpgrade fence-agents-apc-snmpUpgrade fence-agents-kdumpUpgrade fence-agents-vmware-restUpgrade fence-virtdUpgrade fence-agents-mpathUpgrade fence-agents-emersonUpgrade fence-agents-virshUpgrade fence-agents-bladecenterUpgrade fence-agents-eaton-snmpUpgrade fence-agents-amt-wsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-cisco-ucsUpgrade fence-agents-computeUpgrade fence-agents-epsUpgrade fence-agents-rhevmUpgrade fence-agents-hpbladeUpgrade fence-agents-rsbUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-ilo2Upgrade fence-agents-rsaUpgrade fence-agents-sbdUpgrade fence-agents-ibm-powervsUpgrade fence-agents-drac5 | Jul 2, 2026 | Jun 16, 2026 |
| Redhat_linux | — | Upgrade fence-agents-awsUpgrade fence-agents-virshUpgrade fence-agents-ilo2Upgrade fence-agents-ibm-vpcUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-common-debuginfoUpgrade fence-agents-computeUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-redfishUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-wtiUpgrade fence-agents-commonUpgrade fence-agents-drac5Upgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ifmibUpgrade fence-virtd-cpgUpgrade fence-agents-cisco-ucsUpgrade fence-agents-mpathUpgrade fence-agents-rsaUpgrade fence-agents-rsbUpgrade fence-agents-apc-snmpUpgrade fence-agents-kdumpUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-lparUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-openstackUpgrade fence-agents-emersonUpgrade fence-agents-debugsourceUpgrade fence-agents-amt-wsUpgrade fence-virtdUpgrade fence-agents-epsUpgrade fence-agents-ibm-powervsUpgrade fence-agents-allUpgrade fence-agents-scsiUpgrade fence-agents-intelmodularUpgrade fence-agents-debuginfoUpgrade fence-agents-vmware-restUpgrade ha-cloud-supportUpgrade fence-agents-bladecenterUpgrade fence-virtd-multicastUpgrade fence-agents-ilo-sshUpgrade fence-agents-aliyunUpgrade fence-agents-heuristics-pingUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-serialUpgrade fence-agents-ipduUpgrade fence-agents-hpbladeUpgrade fence-agents-gceUpgrade fence-agents-ibmbladeUpgrade fence-virtUpgrade fence-agents-rhevmUpgrade fence-agents-apcUpgrade ha-cloud-support-debuginfoUpgrade fence-virt-debuginfoUpgrade fence-agents-vmware-soapUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo-mpUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-sbdUpgrade fence-agents-cisco-mdsUpgrade fence-virtd-libvirtUpgrade fence-agents-brocadeUpgrade fence-agents-azure-armUpgrade fence-agents-zvmUpgrade fence-agents-ipmilan | Jun 17, 2026 | May 28, 2026 |
| Rocky_linux | — | Upgrade fence-agents-azure-armUpgrade fence-virtd-cpgUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-kdumpUpgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-commonUpgrade fence-agents-zvmUpgrade fence-agents-redfishUpgrade fence-agents-gceUpgrade fence-agents-kubevirtUpgrade fence-agents-debugsourceUpgrade ha-cloud-supportUpgrade fence-virtd-serialUpgrade fence-agents-computeUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-common-debuginfoUpgrade fence-agents-aliyunUpgrade fence-virtd-multicastUpgrade fence-virtUpgrade fence-agents-kdump-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-agents-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-virt-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-openstackUpgrade fence-agents-awsUpgrade fence-agents-allUpgrade fence-virtd | Jun 18, 2026 | Jun 16, 2026 |
| Ubuntu | — | Upgrade python3-jwtUpgrade python3-jwt (Ubuntu Pro)Upgrade python-jwt (Ubuntu Pro) | Sep 28, 2026 | Sep 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub