Ze3Tar

**Name of the Vulnerable Software and Affected Versions** PyJWT versions prior to 2.14.0 **Description** PyJWT is a Python implementation of JSON Web Token standards. The signature segment decoding process accepts characters outside the canonical Base64URL representation when non-Base64URL characters are appended to a valid compact JWS signature segment. This causes the `base64url decode` function to produce identical signature bytes for different serialized segments, which can lead to failures in raw-token revocation checks when attempting to recognize an equivalent modified token. **Recommendations** Update PyJWT to version 2.14.0.

**Name of the Vulnerable Software and Affected Versions** PyJWT versions 2.1.0 through 2.14.0 **Description** The `OKPAlgorithm.from jwk` function in `jwt/algorithms.py` fails to compare the public key derived from `d` with `x` during the private-JWK import process. This occurs when an OKP private JWK provides non-corresponding `x` and `d` components, causing the identity derived from `x` to differ from operations performed with `d`. If an integration accepts private key parameters from a proof header without rejecting them, an attacker could potentially use a stolen sender-constrained token without possessing the legitimate private key. **Recommendations** Update to version 2.15.0.