Thanks for spotting this Tim, I appreciate it. I've patched python-jwt and linked to your article. Please let me know if you file a CVE so I can link to it too.

Thanks for spotting this Tim, I appreciate it. I've patched python-jwt and linked to your article. Please let me know if you file a CVE so I can link to it too. The docs did say: returns: ``(header, claims)`` if the token was verified successfully. The token must pass the following tests: - Its signature must verify using the public key or its algorithm must be ``none``. but passing the responsibility for checking header['alg'] to the caller was the wrong way round so thanks again!