Issues

• [Vuln] JWE AES-CBC-HMAC decryption is a padding oracle — HMAC verified after CBC decrypt/unpad

  mpdavis/python-jose#421 · Filter by author kaii-k opened on Aug 30, 2026

• [Vuln] Uncaught OverflowError / TypeError in jwt.decode() time-claim validation

  mpdavis/python-jose#420 · Filter by author kaii-k opened on Aug 30, 2026

• Security: Algorithm confusion via optional algorithms parameter (CWE-327)

  mpdavis/python-jose#419 · Filter by author SnailSploit opened on Aug 19, 2026

• [Security] HIGH: RSA JWK parameter validation missing; MEDIUM: SHA-1 in RSA_OAEP; algorithms=None bypass

  mpdavis/python-jose#417 · Filter by author Nothern131 opened on Aug 16, 2026
  1

• Confirmation: CVE-2024-33663 HMAC key-confusion reproduced on 3.3.0 vs 3.4.0 (no action needed)

  mpdavis/python-jose#416 · Filter by author plotarmordev opened on Aug 8, 2026

• Algorithm-confusion guard bypassed by DER-encoded public keys (incomplete CVE-2024-33663 fix)

  mpdavis/python-jose#414 · Filter by author geo-chen opened on Jul 6, 2026

• [Security] python-jose ignores the JWS crit header (RFC 7515)

  mpdavis/python-jose#413 · Filter by author kpatsakis opened on Jun 29, 2026

• [Security] RSA1_5 JWE decryption violates RFC 7516 §11.5: wrong-length unwrapped CEK escapes random-CEK substitution and reaches AES key constructor

  mpdavis/python-jose#408 · Filter by author lullu57 opened on May 26, 2026
  1

• [Security] jwt.decode() with audience= accepts tokens missing 'aud' claim (CWE-287)

  mpdavis/python-jose#407 · Filter by author netpack opened on May 18, 2026

• jwt.decode() accepts unsupported critical header extensions

  mpdavis/python-jose#406 · Filter by author fuyu0425 opened on Apr 29, 2026

• Security vulnerability: ECDSA Signature Malleability

  mpdavis/python-jose#403 · Filter by author everping opened on Mar 31, 2026
  1

• Security vulnerability: JWE AES-CBC Padding Oracle (Full Plaintext Recovery)

  mpdavis/python-jose#402 · Filter by author everping opened on Mar 30, 2026

• Security issue: Minerva timing attack vulnerability in python-ecdsa usage

  mpdavis/python-jose#399 · Filter by author serge-eric-kalaga opened on Mar 13, 2026
  2

• Security: DER key algorithm confusion, empty HMAC key, and timing side-channels

  mpdavis/python-jose#398 · Filter by author spartan8806 opened on Mar 8, 2026

• Python 3.14 support

  mpdavis/python-jose#394 · Filter by author kamikaze opened on Nov 26, 2025

• Python-RSA dependency library is retired

  mpdavis/python-jose#392 · Filter by author ashleysommer opened on Oct 17, 2025
  4

• CVE-2024-23342, High level vulnerability

  mpdavis/python-jose#390 · Filter by author navya-sriv opened on Oct 6, 2025
  4

• JWT aud validation raises "Invalid audience" for audience=None

  mpdavis/python-jose#389 · Filter by author temple opened on Jul 22, 2025
  1

• Native .deb release for Debian 13 (Trixie)

  mpdavis/python-jose#378 · Filter by author oscarkrause opened on Apr 17, 2025

• Weak Key Acceptance and Curve Mismatch in ECDSA (ES256/ES384/ES512) Signature Validation

  mpdavis/python-jose#377 · Filter by author JWTSecAPI opened on Apr 16, 2025
  1

• Jwt audience validation: support array instead of only string

  mpdavis/python-jose#374 · Filter by author ericbl opened on Mar 10, 2025

• algorithm confusion issue

  mpdavis/python-jose#367 · Filter by author prasadayush opened on Jan 30, 2025
  1

• Multiple valid JWT Signatures for HMAC Algorithms (base64 malleability)

  mpdavis/python-jose#365 · Filter by author rb-x opened on Dec 29, 2024

• CVE-2024-33663 IS COMING FOR PYTHON JOSE LATEST VERSION 3.3.0

  mpdavis/python-jose#364 · Filter by author parulchawla894 opened on Dec 11, 2024
  1

• iat being set to null is not handled properly

  mpdavis/python-jose#363 · Filter by author Colin-b opened on Sep 25, 2024