high7.0
CVE-2025-45768
pyjwt v2.10.1 was discovered to contain weak encryption.
Impact
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pyjwt Project | Pyjwt | Version 2.10.1 |