JSON Web Token Implementation Vulnerability in PyJWT by Auth0
CVE-2026-32597

7.5HIGH

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
12 March 2026

What is CVE-2026-32597?

A security vulnerability in PyJWT allows the library to accept JSON Web Signature (JWS) tokens containing a 'crit' array with unrecognized extensions. According to the requirements set out in RFC 7515 §4.1.11, the library should reject such tokens to maintain security standards. The unintentional acceptance of these tokens can lead to potential security breaches, as tokens that could introduce unknown behaviors may be processed. This issue has been addressed in version 2.12.0 of PyJWT.

Affected Version(s)

pyjwt < 2.12.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.