pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
References
| Link | Resource |
|---|---|
| https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569 | Issue Tracking |
| https://github.com/jpadilla | Product |
| https://github.com/jpadilla/pyjwt | Product |
Configurations
History
12 Sep 2025, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pyjwt_project:pyjwt:2.10.1:*:*:*:*:*:*:* | |
| First Time |
Pyjwt Project pyjwt
Pyjwt Project |
|
| References | () https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569 - Issue Tracking | |
| References | () https://github.com/jpadilla - Product | |
| References | () https://github.com/jpadilla/pyjwt - Product |
14 Aug 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement). |
04 Aug 2025, 15:06
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
31 Jul 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-31 21:15
Updated : 2025-09-12 16:45
NVD link : CVE-2025-45768
Mitre link : CVE-2025-45768
CVE.ORG link : CVE-2025-45768
JSON object : View
Products Affected
pyjwt_project
- pyjwt
CWE
CWE-311
Missing Encryption of Sensitive Data