Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jpadilla/pyjwt

              master @ 7144e45
            

Fixes

CVEs

CRITICAL

Peak severity

62.5%

Coverage

Highlights

Auth Bypass: 24 prior fixes. Scrutinize any change in this area.

jwt/__init__.py: most-fixed (10 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass signature verification entirely by exploiting key-confusion vulnerabilities where asymmetric PEM or SSH public keys are accepted as HMAC symmetric secrets, or by exploiting bypasses in the 'none' algorithm's verification path.

Auth Bypass: Flawed logic in claim validation allows authentication bypasses via weak string comparison for issuer containment, null values in audience validation, or accepting tokens with future issued-at times.

Cryptographic Issues: Failing to prioritize header-specified algorithms over default API parameters can cause signature validation to occur under incorrect algorithm constraints, leading to algorithm confusion during validation.