PyJWT issuer field partial matches accepted in version 2.10.0
A bug in PyJWT version 2.10.0 allowed partial string matches for the JWT issuer ("iss") claim instead of exact matches, due to a code change from `list` to `Sequence` type checking. The vulnerability was patched in version 2.10.1.
What happened
PyJWT version 2.10.0 introduced a bug in the JWT issuer claim validation. The code changed from checking isinstance(issuer, list) to isinstance(issuer, Sequence), which caused string comparisons to use the in operator instead of equality checking.
This allowed partial string matches for the "iss" claim. For example, a token with issuer "urn:" would be accepted when the expected issuer was "urn:expected", because the substring check "urn:" in "urn:expected" returns true.
Reported impact
The real-world impact is assessed as low because the JWT signature still must match for token validation to succeed. However, the issuer validation could be bypassed by creating tokens with partial issuer strings that match the expected issuer as a substring.
Governance controls
PyJWT published a security advisory (GHSA-75c5-xw7c-p5pm) describing the bug and released version 2.10.1 with a fix. Unit tests were added to prevent regression.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.