CVE-2026-32597

HIGH

PyJWT < 2.12.0 - Insufficient Verification of Data Authenticity via crit Header Parameter

Title source: llm
STIX 2.1

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

References (35)

Core 35
Core References

Scores

CVSS v3 7.5
EPSS 0.0027
EPSS Percentile 18.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-345 CWE-347 CWE-863
Status published
Products (3)
jpadilla/pyjwt < 2.12.0
pyjwt_project/pyjwt < 2.12.0
pypi/PyJWT 0 - 2.12.0PyPI
Published Mar 13, 2026
Tracked Since Mar 14, 2026