Modification of assumed-immutable data in pyjwt - #VU151958

Vulnerability details

The vulnerability allows a remote attacker to bypass claim verification.

The vulnerability exists due to modification of assumed-immutable data in PyJWT._merge_options() when reusing a mutable options dictionary across token decoding calls with different verification settings. A remote attacker can cause an application to accept a signed expired token or a token with incorrect registered claims as valid to bypass claim verification.

Exploitation requires the application to first decode a token with signature verification disabled and then reuse the same options dictionary after enabling signature verification.

Affected software

Remediation

External References

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q

Related Security Bulletins

• Multiple vulnerabilities in pyjwt