CyberRota Analysis
AI-GeneratedThe PyJWT library versions 2.9.0 to 2.14.0 are vulnerable due to improper handling of malformed RSA JWK components, which can lead to authentication failures or denial of service when a malformed key is present in a JWK Set. Organizations utilizing this library for JSON Web Token handling should prioritize upgrading to version 2.14.0 to mitigate potential disruptions in application functionality and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)