CVE-2026-32597: PyJWT insufficient verification of critical header extensions

CVE-2026-32597 · Severity: high · CVSS 7.5 · Published 2026-03-13

PyJWT is a popular Python library used to handle JSON Web Tokens (JWTs), which are commonly used for user authentication and secure data exchange. A vulnerability was found where the library fails to validate 'critical' header parameters, meaning it may accept tokens that include security requirements it does not actually understand or enforce. This could allow an attacker to bypass certain security policies, such as multi-factor authentication (MFA) or token binding, if those policies are defined within the critical header.

Technologies: Jpadilla PyJWT, pyjwt (PyPI). Vendors: Jpadilla, PyPI.

Quick answers

Is CVE-2026-32597 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32597 being exploited in the wild.
How severe is CVE-2026-32597?
High severity, with a CVSS score of 7.5, published 13 March 2026.
Which products and versions are affected?
Jpadilla PyJWT < 2.12.0, <= 2.11.0; pyjwt (PyPI) ECOSYSTEM:introduced=0,fixed=2.12.0.
Is there a fix for CVE-2026-32597?
Yes. pyjwt (PyPI): upgrade to 2.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32597 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32597?
Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pyjwt (PyPI): upgrade to 2.12.0 or later
    pip install "pyjwt>=2.12.0"

Technical details

PyJWT prior to version 2.12.0 does not validate the 'crit' (Critical) Header Parameter as defined in RFC 7515 §4.1.11. According to the specification, if a JWS token contains a 'crit' array listing extensions that the recipient does not understand or support, the token MUST be rejected. PyJWT violates this requirement by ignoring unknown extensions listed in the 'crit' header and processing the token as valid. This vulnerability allows for split-brain verification in mixed-library environments and the bypass of security policies (such as MFA enforcement or token binding) that rely on the 'crit' header for semantic enforcement. The issue is fixed in version 2.12.0.

Affected products

  • jpadilla PyJWT < 2.12.0

Identifiers

  • CVE-2026-32597
  • GHSA-752w-5fwx-jx9f
  • PYSEC-2026-120

Timeline

  • 2026-03-12: advisory: GitHub Security Advisory published by maintainer
  • 2026-03-13: disclosed: NVD publication date
  • 2026-03-12: patched: Fixed in version 2.12.0
  • 2026-05-05: other: Debian LTS security update released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.