pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Pyjwt Project Subscribe
Pyjwt Subscribe

Configuration 1 [-]

cpe:2.3:a:pyjwt_project:pyjwt:2.10.1:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-23303 pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569 cve-icon cve-icon cve-icon
https://github.com/jpadilla cve-icon cve-icon cve-icon
https://github.com/jpadilla/pyjwt cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-45768 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-45768 cve-icon
History

Sat, 13 Sep 2025 02:00:00 +0900

Type Values Removed Values Added
First Time appeared Pyjwt Project
Pyjwt Project pyjwt
CPEs cpe:2.3:a:pyjwt_project:pyjwt:2.10.1:*:*:*:*:*:*:*
Vendors & Products Pyjwt Project
Pyjwt Project pyjwt

Fri, 15 Aug 2025 01:15:00 +0900

Type Values Removed Values Added
Description pyjwt v2.10.1 was discovered to contain weak encryption. pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).

Sat, 02 Aug 2025 09:15:00 +0900

Type Values Removed Values Added
Title pyjwt: pyjwt Weak Encryption Vulnerability
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 01 Aug 2025 06:15:00 +0900

Type Values Removed Values Added
Weaknesses CWE-311
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 01 Aug 2025 05:30:00 +0900

Type Values Removed Values Added
Description pyjwt v2.10.1 was discovered to contain weak encryption.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-08-14T16:01:20.161Z

Reserved: 2025-04-22T00:00:00.000Z

Link: CVE-2025-45768

cve-icon Vulnrichment

Updated: 2025-07-31T20:25:00.768Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-31T21:15:27.320

Modified: 2025-09-12T16:45:51.510

Link: CVE-2025-45768

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-31T00:00:00Z

Links: CVE-2025-45768 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses