PyJWT security flaw in versions 2.11.0-2.13.0 allows JWT claim verification bypass

·1 views

A state pollution vulnerability in PyJWT versions 2.11.0 through 2.13.0 allows attackers to bypass security claim verification. The flaw exists in the library's option merging method, which modifies mutable configuration dictionaries in-place. When an application reuses a configuration dictionary where signature verification was initially disabled, critical claim validations like expiration, audience, and issuer checks remain disabled even when verification is re-enabled. This allows expired or invalid JSON Web Tokens to be incorrectly accepted. Users must upgrade to PyJWT version 2.14.0 or higher to fix the issue.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Guide: Building a Custom CRM with Python and SQLite

A new tutorial details how to create a simple Customer Relationship Management system using Python and SQLite. The guide is aimed at entrepreneurs, developers, or small business owners seeking a cost-effective and customizable alternative to commercial CRM platforms. The project emphasizes data sovereignty, as information is stored locally instead of with external providers, and avoids recurring subscription fees. The step-by-step instructions cover setting up a development environment, designing a database schema, and building a functional application to track client interactions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Colombia mandates electronic invoicing, guide outlines automation for SMEs

Colombia's DIAN has made electronic invoicing mandatory for most taxpayers since its 2022 resolution. The manual process poses an operational burden and error risk, especially for small and medium businesses. Automating the process can reduce time, eliminate human error, and ensure sustainable regulatory compliance. A practical guide explores the technical elements involved and how to implement an automated workflow using accessible tools and Python code. The process involves generating a specific XML format, applying a digital signature, and transmitting it to DIAN's validation system.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide: Add OIDC Authentication to Undertow Apps Using Pac4j Library

A technical guide explains how to secure a Java Undertow web application using the OpenID Connect protocol. Developers can integrate authentication by adding security, callback, and logout handlers from the undertow-pac4j library. The application can connect to external identity providers like Keycloak, Google, or Microsoft Entra ID. The example uses Java 17, Undertow version 2.4, and undertow-pac4j version 6.1.0.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vaynerov's AI project estimator keeps pricing separate from language model

Vaynerov Technologies built an AI tool called Project Blueprint that generates project architecture and team plans from product descriptions. The system deliberately keeps pricing calculations separate from the language model, using an external calculation engine instead. All model suggestions for platforms and features undergo validation and sanitization before being sent to the pricing engine. This design ensures pricing remains consistent with business rules while making the AI's influence on recommendations transparent.

0 comments Read more at DEV Community