Modification of assumed-immutable data in pyjwt - #VU150519

Vulnerability details

The vulnerability allows a remote attacker to bypass claim verification.

The vulnerability exists due to modification of assumed-immutable data in PyJWT._merge_options() when reusing a mutable options dictionary across decode() or decode_complete() calls with different verification settings. A remote attacker can cause an application to accept a signed token with expired or mismatched registered claims as valid to bypass claim verification.

Signature verification is unaffected; exploitation requires reuse of the same options dictionary after a call with signature verification disabled.

Affected software

Remediation

External References

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q