Is CVE-2026-103001 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103001 being exploited in the wild.

How severe is CVE-2026-103001?

Medium severity, with a CVSS score of 6.5, published 30 September 2026.

Which products and versions are affected?

Jpadilla PyJWT 2.13.0; likely 2.9.0+; pyjwt (PyPI) >= 2.11.0, <= 2.13.0, ECOSYSTEM:introduced=2.11.0,last_affected=2.13.0.

Is there a fix for CVE-2026-103001?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103001 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103001?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103001: PyJWT decode() options-dict mutation enabling claim-verification bypass

Q: Is there a fix for CVE-2026-103001?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-103001 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-103001?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103001 · Severity: medium · CVSS 6.5 · Published 2026-09-30

PyJWT is a library for creating and verifying cryptographic tokens used in API authentication and authorization. A flaw causes PyJWT to silently disable claim verification (expiration, issuer, audience checks) when application code reuses the same options configuration object across multiple token validation calls. This allows attackers to provide expired or incorrectly-signed tokens that are accepted as valid if the verification settings from a previous insecure call are still in place.

Technologies: Jpadilla PyJWT, pyjwt (PyPI). Vendors: Jpadilla, PyPI.

Quick answers

Is CVE-2026-103001 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103001 being exploited in the wild.
How severe is CVE-2026-103001?: Medium severity, with a CVSS score of 6.5, published 30 September 2026.
Which products and versions are affected?: Jpadilla PyJWT 2.13.0; likely 2.9.0+; pyjwt (PyPI) >= 2.11.0, <= 2.13.0, ECOSYSTEM:introduced=2.11.0,last_affected=2.13.0.
Is there a fix for CVE-2026-103001?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103001 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103001?: Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The _merge_options() method in jwt/api_jwt.py mutates caller-supplied options dictionaries in place by adding verify_exp, verify_nbf, verify_iat, verify_aud, verify_iss, verify_sub, and verify_jti keys when verify_signature is falsy. If an application reuses the same mutable options dict across calls with different verification intents, a subsequent call with verify_signature=True inherits the disabled claim checks from the earlier call, bypassing expiration and issuer/audience/subject validation despite explicit request for full verification. This is a regression from PR #1045 (merged 2025-03-05) that removed a shallow-copy guard present in the pre-2025 code.

Affected products

jpadilla PyJWT 2.13.0; likely 2.9.0+

Identifiers

CVE-2026-103001
GHSA-gvp8-978c-rx2q
PYSEC-2026-4146

Timeline

2026-09-30: disclosed: GHSA-gvp8-978c-rx2q advisory published
2025-03-05: other: PR #1045 merged, reintroducing the options-dict mutation regression
2022: other: Original issue #679 fixed in PR #743 with shallow-copy guard

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.