Description
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
Published: 2025-07-31
Score: 7 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-23303 pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
History

Fri, 12 Sep 2025 19:00:00 +0200

Type Values Removed Values Added
First Time appeared Pyjwt Project
Pyjwt Project pyjwt
CPEs cpe:2.3:a:pyjwt_project:pyjwt:2.10.1:*:*:*:*:*:*:*
Vendors & Products Pyjwt Project
Pyjwt Project pyjwt

Thu, 14 Aug 2025 18:15:00 +0200

Type Values Removed Values Added
Description pyjwt v2.10.1 was discovered to contain weak encryption. pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).

Sat, 02 Aug 2025 02:15:00 +0200

Type Values Removed Values Added
Title pyjwt: pyjwt Weak Encryption Vulnerability
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 31 Jul 2025 23:15:00 +0200

Type Values Removed Values Added
Weaknesses CWE-311
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 31 Jul 2025 22:30:00 +0200

Type Values Removed Values Added
Description pyjwt v2.10.1 was discovered to contain weak encryption.
References

Subscriptions

Pyjwt Project Pyjwt
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-08-14T16:01:20.161Z

Reserved: 2025-04-22T00:00:00.000Z

Link: CVE-2025-45768

cve-icon Vulnrichment

Updated: 2025-07-31T20:25:00.768Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-31T21:15:27.320

Modified: 2026-06-17T09:25:40.987

Link: CVE-2025-45768

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-31T00:00:00Z

Links: CVE-2025-45768 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-311

    Missing Encryption of Sensitive Data