LOW SEVERITYCONFIRMED

jwt.decode(None) raises AttributeError instead of JWTError

Package
python-jose
Version
3.5.0
Verified
2026-03-28

Description

Passing `None` as the token to `jwt.decode()` raises `AttributeError: 'NoneType' object has no attribute 'rsplit'` instead of `JWTError`. Callers that catch `JWTError` to handle malformed token inputs will not catch this case, leaving an unhandled exception.

Reproduction

from jose import jwt
jwt.decode(None, "secret", algorithms=["HS256"])
# AttributeError: 'NoneType' object has no attribute 'rsplit'
← All bugsScan your code →