Skip to main content

Pyjwt CVE-2026-32597

| EUVDEUVD-2026-11728 HIGH
Insufficient Verification of Data Authenticity (CWE-345)
2026-03-13 security-advisories@github.com GHSA-752w-5fwx-jx9f
Python Information Disclosure Pyjwt Pyjwt Project
7.5
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft JWS token with unknown critical header
  2. Exploit
    Include crit array with unrecognized extensions
  3. Execution
    PyJWT accepts token without validation
  4. Impact
    Bypass security controls intended by token issuer

Vulnerability Assessment

Weakness
CWE
CWE-345
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
Exploitation Conditions

PyJWT versions prior to 2.12.0 used to validate JWS tokens. Attacker must control token creation or interception point. Target application must rely on PyJWT for token validation without additional crit parameter enforcement.
Impact

Despite the high CVSS score of 7.5 (High severity), multiple signals indicate low real-world risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) shows network-accessible attacks with no authentication required but only integrity impact. However, the EPSS score of 0.01% (3rd percentile) suggests extremely low exploitation probability. The vulnerability is not listed in CISA's KEV catalog, indicating no known active exploitation. No proof-of-concept code is mentioned in the references. This appears to be a specification compliance issue with limited practical attack scenarios, making it a lower priority than the CVSS score suggests.
Exploit ScenarioDerived

An attacker could craft a malicious JWT containing a 'crit' header with custom extension names that PyJWT doesn't recognize. Since the library incorrectly accepts these tokens instead of rejecting them, the attacker could potentially inject security-critical claims that bypass intended validation logic. For example, an attacker might add a critical extension that modifies authorization scopes or user privileges, which PyJWT would ignore rather than reject, potentially allowing unauthorized access. However, successful exploitation requires the application to rely solely on PyJWT's validation without additional security controls.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

PyJWT versions before 2.12.0 fail to validate the 'crit' (Critical) header parameter in JSON Web Signatures (JWS), accepting tokens with unrecognized critical extensions instead of rejecting them as required by RFC 7515. This allows attackers to potentially bypass security mechanisms by injecting malicious critical extensions that the library ignores, leading to integrity compromise. With an EPSS score of only 0.01% and no KEV listing, this represents a low real-world exploitation risk despite the high CVSS score.

RemediationAI

Update PyJWT to version 2.12.0 or later, which includes the fix for proper 'crit' header validation. The GitHub Security Advisory (GHSA-752w-5fwx-jx9f) provides detailed information about the fix. No workarounds are mentioned in the available references. Organizations should audit their Python dependencies and update any applications using PyJWT versions below 2.12.0.

Affected VersionsENISA

pyjwt < 2.12.0

Affected Packages

pypi pyjwt fix: 2.12.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

PyJWT is a Python implementation of JSON Web Tokens (JWT) used for secure information exchange. The vulnerability stems from improper validation of the 'crit' header parameter defined in RFC 7515 §4.1.11, which lists critical extensions that MUST be understood and processed by the implementation. The CWE-345 classification indicates insufficient verification of data authenticity, where PyJWT accepts tokens containing unknown critical extensions rather than rejecting them. This violates the JWT specification's security requirements for handling critical headers.

Know when Pyjwt gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 13, 2026 - 19:55 nvd
HIGH 7.5

DescriptionCVE.org

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 21 pypi packages depend on pyjwt (18 direct, 3 indirect)

Ecosystem-wide dependent count for version 2.12.0.

Executive ViewAI

Why It Matters

PyJWT library versions before 2.12.0 contain a vulnerability that could allow attackers to bypass JWT validation controls by injecting unrecognized critical extensions. Organizations using affected PyJWT versions in authentication or API security workflows should assess exposure, though real-world exploitation risk remains low based on current threat intelligence.

Business Impact: Low
Compensating Controls

Implement strict JWT validation at API gateway/WAF layer using third-party JWT validation libraries known to enforce RFC 7515 'crit' header validation. Disable JWT algorithm flexibility to accept only explicitly whitelisted algorithms. Add runtime monitoring to detect anomalous JWT structures with unrecognized extensions. Implement network segmentation to limit token usage scope and reduce blast radius if validation is bypassed.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Low

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Pyjwt

View all
CVE-2026-102266 CRITICAL POC
9.1 Sep 28

Forged HS256 JSON Web Tokens can be accepted as authentic by PyJWT (pip package PyJWT) versions 2.13.0 through 2.13.x wh
CVE-2026-102275 HIGH POC
8.2 Sep 28

Improper validation in PyJWT 2.1.0 through 2.14.0 allows an attacker who already holds a stolen sender-constrained (DPoP
CVE-2026-102274 HIGH POC
7.5 Sep 28

Denial of service in PyJWT 2.9.0 through 2.13.0: a single malformed RSA JWK embedded in a JWK Set aborts construction of
CVE-2026-101918 HIGH POC
7.5 Sep 28

Unauthenticated denial of service in the PyJWT Python library (versions 2.0.0a1 through 2.14.0) allows a remote attacker
CVE-2024-53861 HIGH POC
7.5 Nov 29

pyjwt is a JSON Web Token implementation in Python. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2026-48526 HIGH POC
7.4 May 28

Authentication bypass in PyJWT versions prior to 2.13.0 allows remote attackers to forge valid JSON Web Tokens by exploi
CVE-2026-103001 MEDIUM POC
6.5 Sep 30

Reuse of a caller-supplied options mapping in PyJWT 2.11.0 through 2.13.0 can silently leave registered-claim verificati
CVE-2026-102265 MEDIUM POC
5.3 Sep 28

Malformed JSON Web Token headers can cause an uncaught RecursionError in PyJWT 2.13.0 through versions before 2.14.0, re
CVE-2026-48525 MEDIUM POC
5.3 May 28

Uncontrolled resource consumption in PyJWT 2.8.0-2.12.1 exposes any service that verifies detached JWS tokens to unauthe
CVE-2026-102268 CRITICAL
9.1 Sep 28

Signature forgery in PyJWT before 2.14.0 allows an attacker who knows a target's asymmetric public key to forge HMAC-aut
CVE-2026-102267 CRITICAL
9.1 Sep 28

JWKS trust-boundary bypass in PyJWT's PyJWKClient allows a configured trusted JWKS endpoint that returns an HTTP 3xx red
CVE-2026-48524 LOW POC
3.7 May 28

Unconstrained outbound JWKS requests in PyJWT's PyJWKClient.get_signing_key() allow unauthenticated remote attackers to

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all
CVE-2023-38831 HIGH POC
7.8
CVE-2016-4553 HIGH
8.6
CVE-2016-4554 HIGH
8.6
CVE-2014-4936 CRITICAL POC
9.3
CVE-2025-66255 CRITICAL POC
9.9
CVE-2026-62874 CRITICAL POC
9.8
CVE-2025-1945 CRITICAL POC
9.8
CVE-2026-92161 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.74 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.50 Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6568 ADVISORY https://access.redhat.com/errata/RHSA-2026:6720 ADVISORY https://access.redhat.com/errata/RHSA-2026:6912 ADVISORY https://access.redhat.com/errata/RHSA-2026:6926 ADVISORY https://access.redhat.com/errata/RHSA-2026:8437 ADVISORY https://access.redhat.com/errata/RHSA-2026:8746 ADVISORY https://access.redhat.com/errata/RHSA-2026:8747 ADVISORY https://access.redhat.com/errata/RHSA-2026:8748 ADVISORY https://vuldb.com/?id.350791 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1199/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1389/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1400/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20839/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20869/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20879/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20934/ REF https://access.redhat.com/errata/RHSA-2026:10140 REF https://access.redhat.com/errata/RHSA-2026:10141 REF https://access.redhat.com/errata/RHSA-2026:10184 REF https://access.redhat.com/errata/RHSA-2026:12176 REF https://access.redhat.com/errata/RHSA-2026:13508 REF https://access.redhat.com/errata/RHSA-2026:13512 REF https://access.redhat.com/errata/RHSA-2026:13545 REF https://access.redhat.com/errata/RHSA-2026:13553 REF https://access.redhat.com/errata/RHSA-2026:13672 REF https://access.redhat.com/errata/RHSA-2026:13916 REF https://access.redhat.com/errata/RHSA-2026:17083 REF https://access.redhat.com/errata/RHSA-2026:19138 REF https://access.redhat.com/errata/RHSA-2026:19355 REF https://access.redhat.com/errata/RHSA-2026:19375 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/errata/RHSA-2026:21431 REF https://access.redhat.com/errata/RHSA-2026:21517 REF https://access.redhat.com/errata/RHSA-2026:22330 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:26226 REF https://access.redhat.com/errata/RHSA-2026:37275 REF https://access.redhat.com/errata/RHSA-2026:42644 REF https://access.redhat.com/security/cve/CVE-2026-32597 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447194 REF https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f REF https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy