CVE-2026-32597
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
PyJWT before version 2.12.0 does not validate the crit (Critical) Header Parameter defined in RFC 7515. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it, violating the MUST requirement in the RFC.
Risk Assessment
An attacker can inject unsupported extensions into a JWT token, potentially leading to security bypass or unexpected behavior.
Recommendation
Update PyJWT to version 2.12.0 or later, which includes the fix.
Other vulnerabilities in PyJWT
See all- CVE-2017-11424High
In PyJWT versions 1.5.0 and below, the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format is allowed, enabling symmetric/asymmetric key confusion attacks.
- CVE-2026-48526High
PyJWT library in Python prior to 2.13.0 does not validate the use of JSON Web Keys in HMAC algorithm, allowing an attacker to use the issuer's public key as the HMAC secret key.
Original NVD description (English source)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.