CVE-2026-6911: Python Jwt Payload Decoded Without Signature Verification
JWT payload is parsed by manually splitting the token on '.' and base64url-decoding the payload segment, then trusting the resulting claims without verifying the cryptographic signature. An attacker can forge a token whose payload contains arbitrary claims (e.g. `sub`, `aud`, `iss`, `exp`, custom role/admin claims) and the syntactic claim checks will pass be
Pythongreprules fetch cve-2026-6911-python-jwt-payload-decoded-without-signature-verification --engine opengrepDescription
JWT payload is parsed by manually splitting the token on '.' and base64url-decoding the payload segment, then trusting the resulting claims without verifying the cryptographic signature. An attacker can forge a token whose payload contains arbitrary claims (e.g. `sub`, `aud`, `iss`, `exp`, custom role/admin claims) and the syntactic claim checks will pass be
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.