All issues

Search results

Security: Algorithm confusion via optional algorithms parameter (CWE-327)

Status: Open.

#419In mpdavis/python-jose;

· SnailSploit opened on Aug 19, 2026

[Security] HIGH: RSA JWK parameter validation missing; MEDIUM: SHA-1 in RSA_OAEP; algorithms=None bypass

Status: Open.

#417In mpdavis/python-jose;

· Nothern131 opened on Aug 16, 2026

Confirmation: CVE-2024-33663 HMAC key-confusion reproduced on 3.3.0 vs 3.4.0 (no action needed)

Status: Open.

#416In mpdavis/python-jose;

· plotarmordev opened on Aug 8, 2026

Algorithm-confusion guard bypassed by DER-encoded public keys (incomplete CVE-2024-33663 fix)

Status: Open.

#414In mpdavis/python-jose;

· geo-chen opened on Jul 6, 2026

[Security] python-jose ignores the JWS crit header (RFC 7515)

Status: Open.

#413In mpdavis/python-jose;

· kpatsakis opened on Jun 29, 2026

[Security] RSA1_5 JWE decryption violates RFC 7516 §11.5: wrong-length unwrapped CEK escapes random-CEK substitution and reaches AES key constructor

Status: Open.

#408In mpdavis/python-jose;

· lullu57 opened on May 26, 2026

[Security] jwt.decode() with audience= accepts tokens missing 'aud' claim (CWE-287)

Status: Open.

#407In mpdavis/python-jose;

· netpack opened on May 18, 2026

jwt.decode() accepts unsupported critical header extensions

Status: Open.

#406In mpdavis/python-jose;

· fuyu0425 opened on Apr 29, 2026

Security vulnerability: ECDSA Signature Malleability

Status: Open.

#403In mpdavis/python-jose;

· everping opened on Mar 31, 2026

Security vulnerability: JWE AES-CBC Padding Oracle (Full Plaintext Recovery)

Status: Open.

#402In mpdavis/python-jose;

· everping opened on Mar 30, 2026

Security issue: Minerva timing attack vulnerability in python-ecdsa usage

Status: Open.

#399In mpdavis/python-jose;

· serge-eric-kalaga opened on Mar 13, 2026

Security: DER key algorithm confusion, empty HMAC key, and timing side-channels

Status: Open.

#398In mpdavis/python-jose;

· spartan8806 opened on Mar 8, 2026