Search results

[Security] RSA1_5 JWE decryption violates RFC 7516 §11.5: wrong-length unwrapped CEK escapes random-CEK substitution and reaches AES key constructor

Status: Open.

#408 In mpdavis/python-jose;

· lullu57 opened on May 26, 2026

[Security] jwt.decode() with audience= accepts tokens missing 'aud' claim (CWE-287)

Status: Open.

#407 In mpdavis/python-jose;

· netpack opened on May 18, 2026

jwt.decode() accepts unsupported critical header extensions

Status: Open.

#406 In mpdavis/python-jose;

· fuyu0425 opened on Apr 29, 2026

Security vulnerability: ECDSA Signature Malleability

Status: Open.

#403 In mpdavis/python-jose;

· everping opened on Mar 31, 2026

Security vulnerability: JWE AES-CBC Padding Oracle (Full Plaintext Recovery)

Status: Open.

#402 In mpdavis/python-jose;

· everping opened on Mar 30, 2026

Security issue: Minerva timing attack vulnerability in python-ecdsa usage

Status: Open.

#399 In mpdavis/python-jose;

· serge-eric-kalaga opened on Mar 13, 2026

Security: DER key algorithm confusion, empty HMAC key, and timing side-channels

Status: Open.

#398 In mpdavis/python-jose;

· spartan8806 opened on Mar 8, 2026

Python 3.14 support

Status: Open.

#394 In mpdavis/python-jose;

· kamikaze opened on Nov 26, 2025

Python-RSA dependency library is retired

Status: Open.

#392 In mpdavis/python-jose;

· ashleysommer opened on Oct 17, 2025

CVE-2024-23342, High level vulnerability

Status: Open.

#390 In mpdavis/python-jose;

· navya-sriv opened on Oct 6, 2025

JWT aud validation raises "Invalid audience" for audience=None

Status: Open.

#389 In mpdavis/python-jose;

· temple opened on Jul 22, 2025

Native .deb release for Debian 13 (Trixie)

Status: Open.

#378 In mpdavis/python-jose;

· collinwebdesigns opened on Apr 17, 2025