HIGH🇵🇱 Wersja polska

CVE-2026-32597

CVSS 7.5v3.1pub. 2026-03-13upd. 2026-07-01

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Pyjwt Project Pyjwt

    APP
    Pyjwt Project
    < 2.12.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-48526HIGH7.4ten sam produkt

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web To...

CVE-2025-45768HIGH7.0ten sam produkt

pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the ke...

CVE-2022-29217HIGH7.4ten sam produkt

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With J...

CVE-2017-11424HIGH7.5ten sam produkt

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all P...

CVE-2026-48522MEDIUM4.2ten sam produkt

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument direc...