CVE-2025-45768

disputed upstream

The "insufficient key length" seems to refer to the fact that pyjwt does not enforce that a key

Generating a key of insufficient length for the purpose you want to use it for is a user problem.

A library may not decide that my key length is insufficient, as it has no way to determine what the goal of my token is.

https://github.com/jpadilla/pyjwt/issues/1080

https://github.com/advisories/GHSA-xpf8-484v-j9w6

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-72ff-rqxp-4hrh