The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token.

CVE-2022-3102 is specific to cases where jwcrypto's tokens are used for authentication or authorization. It requires an unlikely configuration where the application verifying tokens has access to the private key that was used to sign them. Given that python-jwcrypto is not used in AL2 for authentication or authorization and the special conditions required to exploit CVE-2022-3102, a fix will not be provided at this time for Amazon Linux 2.