Python Web Token Implementation Vulnerability in PyJWT

CVE-2026-103001

What is CVE-2026-103001?

A vulnerability exists in the PyJWT library from versions 2.11.0 to 2.13.0, where the PyJWT._merge_options() method can unintentionally alter a caller-supplied mutable options mapping if the verify_signature parameter is set to false. This manipulation can lead to scenarios where, upon later calls to decode() or decode_complete() with verify_signature true, the mapping retains false values for important claim checks like expiration and audience. As a result, signed tokens that hold invalid registered claims may be accepted, potentially compromising the security of applications that do not create new options mappings for each call.

References