Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an algorithm allow-list bypass in PyJWT that occurs when decoding a JWT using a PyJWK object as the verification key. The root cause is located in the PyJWS._verify_signature function in jwt/api_jws.py. When a PyJWK key is used, the function incorrectly uses the algorithm that is pre-bound to the PyJWK object (key.Algorithm) for signature verification, instead of using the algorithm specified in the JWT's header (alg).
Crucially, the validation check against the user-provided algorithms allow-list is still performed on the header's alg value. This discrepancy allows an attacker to bypass cryptographic policy. An attacker can sign a JWT with a disallowed algorithm (e.g., a weak one), but place an allowed algorithm in the JWT header. The verifier, using jwt.decode with a PyJWK key, will pass the allow-list check based on the header, but then proceed to verify the signature using the different, and potentially insecure, algorithm bound to the key.
This issue was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1, which added the special handling for PyJWK keys that leads to this vulnerability. The functions decode and decode_complete across both PyJWS and PyJWT classes are the entry points that expose this flawed logic when passed a PyJWK key.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyjwt | pip | >= 2.9.0, < 2.13.0 | 2.13.0 |
