CVE-2024-53861

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-697

• https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366Patch
• https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1Patch
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pmExploit, Vendor Advisory

Published

Nov 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53856rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14…7.5
• CVE-2024-53857rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14…7.5
• CVE-2024-53858The gh cli is GitHub’s official command line tool. A securit…6.5
• CVE-2024-53859go-gh is a Go module for interacting with the `gh` utility a…7.5
• CVE-2024-5386In lunary-ai/lunary version 1.2.2, an account hijacking vuln…8.8
• CVE-2024-53860sp-php-email-handler is a PHP package for handling contact f…8.6
• CVE-2024-53862Argo Workflows is an open source container-native workflow e…7.5
• CVE-2024-53863Synapse is an open-source Matrix homeserver. In Synapse vers…9.1
• CVE-2024-53864Ibexa Admin UI Bundle is all the necessary parts to run the …5.3
• CVE-2024-53865zhmcclient is a pure Python client library for the IBM Z HMC…8.2
• CVE-2024-53866The package manager pnpm prior to version 9.15.0 seems to mi…9.8
• CVE-2024-53867Synapse is an open-source Matrix homeserver. The Sliding Syn…4.3