jpadilla/pyjwt

Scanned on May 11, 2026

Risk score/ 100

High risk

Summary

PyJWT library exhibits high quantum vulnerability with 95 instances of quantum-susceptible algorithms including RSA, ECDSA (NIST P-256/384/521), and Ed25519. As a widely-used JWT implementation library, migration to post-quantum cryptography is critical to protect token integrity against future quantum attacks. The library's core cryptographic infrastructure requires comprehensive redesign to support NIST-approved PQC algorithms.

Critical

High

Medium

Low

Top findings

HighElliptic Curve Cryptography
tests/test_api_jws.py:28
Raw evidence
```
EllipticCurvePublicKey,
```
HighElliptic Curve Cryptography
jwt/algorithms.py:47
Raw evidence
```
EllipticCurvePrivateKey,
```
Highsecp256k1 (Bitcoin curve)
tests/test_api_jwk.py:124
Raw evidence
```
def test_should_load_key_ec_secp256k1_from_dict(self) -> None:
```
HighECDSA
jwt/algorithms.py:41
ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+)
Raw evidence
```
ECDSA,
```
HighNIST P-256 curve
jwt/algorithms.py:43
ML-KEM or ML-DSA
Raw evidence
```
SECP256R1,
```

+ 92 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan