# CVE-2024-53861: PYSEC-2026-1814 - PyJWT Issuer field partial matches allowed

Source: https://junglewise.ai/threats/cve-2024-53861-pyjwt-issuer-field-partial-matches-allowed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2024-53861 · Severity: low · CVSS 3.1 · Published 2026-07-07

PyJWT Issuer field partial matches allowed

Technologies: [pyjwt (PyPI)](https://junglewise.ai/threats/technologies/pypi-pyjwt). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-53861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-53861 being exploited in the wild.

**How severe is CVE-2024-53861?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** pyjwt (PyPI) ECOSYSTEM:introduced=2.10.0,fixed=2.10.1.

**Is there a fix for CVE-2024-53861?** Yes. pyjwt (PyPI): upgrade to 2.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-53861?** Check whether you run pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyjwt (PyPI): upgrade to 2.10.1 or later

  ```sh
  pip install "pyjwt>=2.10.1"
  ```


## Affected products

- pyjwt (PyPI) ECOSYSTEM:introduced=2.10.0,fixed=2.10.1

## Identifiers

- CVE-2024-53861
- GHSA-75c5-xw7c-p5pm
- PYSEC-2026-1814

## Related threats

- [PyJWT HS256/384/512 token forgery via empty HMAC key in oct JWK](https://junglewise.ai/threats/pyjwt-hs256-384-512-verify-accepts-empty-hmac-key-via-oct-jwk-pyjwk-a3ba63d2)
- [PyJWT decode() options-dict mutation enabling claim-verification bypass](https://junglewise.ai/threats/cve-2026-103001-pyjwt-decode-reintroduces-options-dict-mutation-enabling-silent)
- [PyJWT OKP algorithm key validation bypass](https://junglewise.ai/threats/cve-2026-102275-pyjwt-is-a-python-implementation-of-json-web-token-standards)
- [PyJWT unhandled ValueError in JWK Set parsing](https://junglewise.ai/threats/cve-2026-102274-pyjwt-is-a-python-implementation-of-json-web-token-standards)
- [PyJWT HMAC key validation bypass in HMACAlgorithm.prepare_key](https://junglewise.ai/threats/cve-2026-102273-pyjwt-is-a-python-implementation-of-json-web-token-standards)