CVE-2024-53861
pyjwt: Issuer field partial matches allowed in pyjwt
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 30, 2024
Updated · November 4, 2026
Description
A flaw was found in the pyJWT package. An incorrect string comparison is run for iss checking, which allows for partial matches. This results in if "abc" not in "__abcd__": being checked instead of if "abc" != "__abc__":. Signature checks are still present so real world impact is likely limited to denial of service scenarios.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 2.2CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE-697 · Incorrect Comparison