CVE-2024-53861

What it actually does

Incorrect string comparison logic during JWT 'iss' claim validation accepts partial/substring matches (e.g., 'acb' accepted for expected '_abc_'), bypassing intended issuer verification.

Why it matters to the business

Attackers may obtain unauthorized access to resources protected by JWT-based authentication in applications using the vulnerable PyJWT library, though the flaw is narrow in scope.

How an attack unfolds

An attacker generates a JWT token containing an 'iss' claim value that is a substring or partial match of the expected issuer string, submits it to an application endpoint relying on PyJWT for validation, and gains access because the flawed check passes the token as valid.

How to fix it

Upgrade jpadilla/pyjwt to the commit 33022c25525c1020869e71ce2a4109e44ae4ced1 or later release containing the corrected 'iss' string comparison logic.

How to confirm the fix worked

Verify the installed PyJWT version or source tree contains commit 33022c25525c1020869e71ce2a4109e44ae4ced1; re-run unit tests covering 'iss' claim validation with both exact and partial issuer strings to confirm rejection of mismatches.

Typical attack path

1. Identify an application endpoint that accepts and validates PyJWT-signed tokens for authentication or authorization.
2. Craft a JWT with a forged 'iss' claim using a partial match of the legitimate issuer string.
3. Submit the token in an authentication request or API call.
4. Bypass issuer validation and obtain a valid session or resource access.

How to detect it

Search application and authentication logs for JWT tokens where the 'iss' claim value is accepted despite not exactly matching the configured expected issuer string; inspect token validation paths in code for the flawed comparison.

What your security team should do

• Immediately audit all applications for use of PyJWT and schedule upgrade to the fixed commit.
• Review JWT validation code for any custom 'iss' handling that may compound the issue.
• Monitor authentication logs for unexpected issuer values until patches are applied.