kunthawat/ALwrity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b894bc0abb835f4f6f945cd6af67c1aa24cb3347
ALwrity/backend/middleware/auth_middleware.py
ajaysi b894bc0abb fix: GHSA-426f-p74m-73fv — JWT JWKS issuer confusion auth bypass (CVSS 9.4) 
Pin issuer and JWKS URL at startup from CLERK_PUBLISHABLE_KEY.
Validate token iss claim before any JWKS fetch.
Add issuer= to jwt.decode() with verify_iss=True.
2026-06-05 12:07:22 +05:30

28 KiB
Raw Blame History

View Raw
Reference in New Issue View Git Blame Copy Permalink