Threats tagged 'brew-hermes-agent-cve-2026-103001'

PyJWT versions from 0.21.6 up to but not including 0.22.4, and versions from 2026.4.30 through 2026.9.24, contain a vulnerability where the decode() function mutates a caller-supplied options dictionary when signature verification is disabled. If the same options dictionary is reused with signature verification enabled later, it can silently bypass claim verifications such as expiration, audience, issuer, and subject checks. This leads to acceptance of expired or otherwise invalid tokens without exceptions. The issue is a regression introduced in March 2025 and fixed in version 0.22.4. The vulnerability has a medium severity with a CVSS score of 6.5.