CVE-2022-39227

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.

• CWE-290

• https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9Patch
• https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fpPatch, Third Party Advisory
• https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yamlThird Party Advisory
• https://www.vicarius.io/vsociety/posts/authentication-bypass-in-python-jwt
• https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9Patch
• https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fpPatch, Third Party Advisory
• https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yamlThird Party Advisory
• https://www.vicarius.io/vsociety/posts/authentication-bypass-in-python-jwt

Published

Sep 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39220SFTPGo is an SFTP server written in Go. Versions prior to 2.…6.1
• CVE-2022-39221McWebserver mod runs a simple HTTP server alongside the Mine…7.5
• CVE-2022-39222Dex is an identity service that uses OpenID Connect to drive…6.5
• CVE-2022-39224Arr-pm is an RPM reader/writer library written in Ruby. Vers…7.8
• CVE-2022-39225Parse Server is an open source backend that can be deployed …3.1
• CVE-2022-39226Discourse is an open source discussion platform. In versions…4.3
• CVE-2022-39228vantage6 is a privacy preserving federated learning infrastr…6.5
• CVE-2022-39229Grafana is an open source data visualization platform for me…4.3
• CVE-2022-3923The ActiveCampaign for WooCommerce WordPress plugin before 1…4.3
• CVE-2022-39230fhir-works-on-aws-authz-smart is an implementation of the au…6.5
• CVE-2022-39231Parse Server is an open source backend that can be deployed …3.7
• CVE-2022-39232Discourse is an open source discussion platform. Starting wi…4.3