CVE-2025-45768

Published: Jul 31, 2025Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 2.2 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).

Affected (1)

Products: Pyjwt Project: Pyjwt

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pyjwt Project Pyjwt	Version 2.10.1

Related CWEs

Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

References (3)

https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569

Source: cve@mitre.org

Issue Tracking

https://github.com/jpadilla

Source: cve@mitre.org

Product

https://github.com/jpadilla/pyjwt

Source: cve@mitre.org

Product

Timeline

No history available yet.