PyJWT Issuer field partial matches allowed
Summary
The wrong string if check is run for iss checking, resulting in "acb" being accepted for "_abc_".
Details
This is a bug introduced in version 2.10.0: checking the "iss" claim
changed from isinstance(issuer, list) to isinstance(issuer, Sequence).
- if isinstance(issuer, list):
+ if isinstance(issuer, Sequence):
if payload["iss"] not in issuer:
raise InvalidIssuerError("Invalid issuer")
else:Since str is a Sequnce, but not a list, in is also used for string
comparison. This results in if "abc" not in "__abcd__": being
checked instead of if "abc" != "__abc__":.
PoC
Check out the unit tests added here: https://github.com/jpadilla/pyjwt-ghsa-75c5-xw7c-p5pm
issuer = "urn:expected"
payload = {"iss": "urn:"}
token = jwt.encode(payload, "secret")
# decode() succeeds, even though `"urn:" != "urn:expected". No exception is raised.
with pytest.raises(InvalidIssuerError):
jwt.decode(token, "secret", issuer=issuer, algorithms=["HS256"])Impact
I would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pyjwt | >= 2.10.0, < 2.10.1 | 2.10.1 |
References
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm
- https://nvd.nist.gov/vuln/detail/CVE-2024-53861
- https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366
- https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1
- https://github.com/jpadilla/pyjwt
- https://pypi.org/project/pyjwt
- https://github.com/advisories/GHSA-75c5-xw7c-p5pm
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-697- Platform
- Python (PyPI)
- Package
pyjwt- Disclosed
- 02.12.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1814 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-75c5-xw7c-p5pm - CC BY 4.0
Vulnerability history: pyjwt
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 24
- First → latest
- 08.2017 09.2026
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 10
- Medium 11
- Low 2
Disclosures per year
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 20
-
PyJWT Issuer field partial matches allowed this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.