Junglewise Threat Intelligence

CVE-2026-32597: PyJWT insufficient verification of critical header extensions

CVE-2026-32597 · Severity: high · CVSS 7.5 · Published 2026-03-13

Technologies: Jpadilla PyJWT, pyjwt (PyPI). Vendors: Jpadilla, PyPI.

Executive brief

PyJWT is a popular Python library used to handle JSON Web Tokens (JWTs), which are commonly used for user authentication and secure data exchange. A vulnerability was found where the library fails to validate 'critical' header parameters, meaning it may accept tokens that include security requirements it does not actually understand or enforce. This could allow an attacker to bypass certain security policies, such as multi-factor authentication (MFA) or token binding, if those policies are defined within the critical header.

Technical details

PyJWT prior to version 2.12.0 does not validate the 'crit' (Critical) Header Parameter as defined in RFC 7515 §4.1.11. According to the specification, if a JWS token contains a 'crit' array listing extensions that the recipient does not understand or support, the token MUST be rejected. PyJWT violates this requirement by ignoring unknown extensions listed in the 'crit' header and processing the token as valid. This vulnerability allows for split-brain verification in mixed-library environments and the bypass of security policies (such as MFA enforcement or token binding) that rely on the 'crit' header for semantic enforcement. The issue is fixed in version 2.12.0.

Affected products

  • jpadilla PyJWT < 2.12.0

Timeline

  • 2026-03-12: advisory: GitHub Security Advisory published by maintainer
  • 2026-03-13: disclosed: NVD publication date
  • 2026-03-12: patched: Fixed in version 2.12.0
  • 2026-05-05: other: Debian LTS security update released

References

Related threats