-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from how verify_jwt handled JWT verification. The fix commit shows it previously used jws.verify(compact_jws) and separately json.loads(payload), creating a mismatch between the verified payload and parsed claims. Attackers could craft tokens where the signed payload differed from the parsed JSON claims. The vulnerable function is clearly verify_jwt as the security boundary where this parsing inconsistency occurred, and the patch modifies this function to use consistent payload handling.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| python-jwt | pip | < 3.3.4 | 3.3.4 |