Introduction
JWTs are a core part of authentication and authorization in modern Python web applications. When a widely used library like PyJWT has a cryptographic flaw, the risk can extend to thousands of production systems. CVE-2025-45768 describes a weak encryption vulnerability in PyJWT v2.10.1, and it raises concerns about the integrity and confidentiality of JWT-based authentication flows.
About PyJWT: PyJWT is the most popular Python implementation of the JSON Web Token standard (RFC 7519). José Padilla and the open source community maintain it, and many frameworks and libraries in the Python ecosystem depend on it.
Technical information
CVE-2025-45768 is classified as a weak encryption vulnerability in PyJWT v2.10.1 and tracked as CWE-311 (Missing Encryption of Sensitive Data). PyJWT supports several signing algorithms, including HMAC (HS256, HS384, HS512), RSA (RS256, RS384, RS512, PS256, PS384, PS512), ECDSA (ES256, ES256K, ES384, ES512), and EdDSA. The vulnerability may affect how PyJWT handles cryptographic operations or key management, but no public code snippet or root cause analysis is available as of this writing.
Earlier PyJWT vulnerabilities include algorithm confusion (CVE-2022-29217) and improper claim validation (CVE-2024-53861). Those issues typically came down to insecure handling of the alg header or insufficient validation of JWT claims. The details of CVE-2025-45768 are not yet public, so it is unclear whether this flaw is in algorithm selection, key handling, or some other cryptographic process.
No exploit details or proof of concept are available for this CVE.
Affected systems and versions
- PyJWT version 2.10.1 is affected by CVE-2025-45768.
- Public sources do not explicitly name any other version as vulnerable.
- No configuration-specific details are available.
Vendor security history
Earlier notable PyJWT vulnerabilities include:
- CVE-2022-29217: Algorithm confusion in versions 1.5.0 through 2.3.0, which allowed signature bypass under certain conditions.
- CVE-2024-53861: An issuer claim validation bug in version 2.10.0, fixed in 2.10.1.
The maintainers have generally responded quickly to reported issues, but cryptographic implementation flaws keep recurring in the project. PyJWT relies on the cryptography package for its crypto operations, and its documentation stresses secure usage patterns, such as explicitly specifying which algorithms to allow.
