CVE-2026-32597
published 2026-03-13CVE-2026-32597: PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.27%
18.9th percentile
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pyjwt | — | — |
| jpadilla | pyjwt | < 2.12.0 | 2.12.0 |
| pyjwt_project | pyjwt | < 2.12.0 | 2.12.0 |
| pyjwt_project | pyjwt | >= 0 < 2.12.0 | 2.12.0 |
| pyjwt_project | pyjwt | >= 0 < 2.13.0 | 2.13.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
ghsa8.8HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
ghsa·2026-06-15·CVSS 8.8
CVE-2026-48522 [HIGH] CWE-441 PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
> [!NOTE]
> The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. Severity is scored for the scheme-acceptance bug in isolation.
## Summary
PyJWKClient passes its `uri` argument directly to `urllib.request.urlopen()` which uses Python stdlib's default `OpenerDirector` registering `HTTPHandler`, `HTTPSHandler`, `FTPHandler`, **`FileHandler`**, and `DataHandler`. There is currently no documented option to restrict w
GHSA
PyJWT accepts unknown `crit` header extensions
ghsa·2026-03-13·CVSS 7.5
CVE-2026-32597 [HIGH] CWE-345 PyJWT accepts unknown `crit` header extensions
PyJWT accepts unknown `crit` header extensions
## Summary
PyJWT does not validate the `crit` (Critical) Header Parameter defined in
RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing
extensions that PyJWT does not understand, the library accepts the token
instead of rejecting it. This violates the **MUST** requirement in the RFC.
This is the same class of vulnerability as CVE-2025-59420 (Authlib),
which received CVSS 7.5 (HIGH).
---
## RFC Requirement
RFC 7515 §4.1.11:
> The "crit" (Critical) Header Parameter indicates that extensions to this
> specification and/or [JWA] are being used that **MUST** be understood and
> processed. [...] If any of the listed extension Header Parameters are
> **not understood and supported** by the recipient, then the **JWS is invalid**
OSV
CVE-2026-32597: PyJWT is a JSON Web Token implementation in Python
osv·2026-03-13·CVSS 7.5
CVE-2026-32597 [HIGH] CVE-2026-32597: PyJWT is a JSON Web Token implementation in Python
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
OSV
PyJWT accepts unknown `crit` header extensions
osv·2026-03-13·CVSS 7.5
CVE-2026-32597 [HIGH] PyJWT accepts unknown `crit` header extensions
PyJWT accepts unknown `crit` header extensions
## Summary
PyJWT does not validate the `crit` (Critical) Header Parameter defined in
RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing
extensions that PyJWT does not understand, the library accepts the token
instead of rejecting it. This violates the **MUST** requirement in the RFC.
This is the same class of vulnerability as CVE-2025-59420 (Authlib),
which received CVSS 7.5 (HIGH).
---
## RFC Requirement
RFC 7515 §4.1.11:
> The "crit" (Critical) Header Parameter indicates that extensions to this
> specification and/or [JWA] are being used that **MUST** be understood and
> processed. [...] If any of the listed extension Header Parameters are
> **not understood and supported** by the recipient, then the **JWS is invalid**
Ubuntu
PyJWT vulnerability
vendor_ubuntu·2026-03-30
CVE-2026-32597 PyJWT vulnerability
Title: PyJWT vulnerability
Summary: PyJWT could allow unintended access to network services.
It was discovered that PyJWT did not validate the critical header
parameter, contrary to the RFC specification expectations. A remote
attacker could possibly use this issue to bypass certain authentication
checks and restrictions.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
vendor_redhat·2026-03-12·CVSS 7.5
CVE-2026-32597 [HIGH] CWE-347 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requ
Debian
CVE-2026-32597: pyjwt - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does ...
vendor_debian·2026·CVSS 7.5
CVE-2026-32597 [HIGH] CVE-2026-32597: pyjwt - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does ...
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-32597 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-32597 [HIGH] CVE-2026-32597 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32597 :
Python vulnerability analysis and mitigation
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Wiz Threat Research note: This vulnerability's initial access potential has been overridden to FALSE by the Wiz Research team, as it does not allow RCE on its own.
Source : NVD
## 7.5
Score
Published March 13, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Python
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CIS
Bugzilla
CVE-2026-32597 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
bugzilla·2026-03-12·CVSS 7.5
CVE-2026-32597 [HIGH] CVE-2026-32597 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
CVE-2026-32597 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9fhttps://lists.debian.org/debian-lts-announce/2026/05/msg00008.htmlhttps://access.redhat.com/errata/RHSA-2026:10140https://access.redhat.com/errata/RHSA-2026:10141https://access.redhat.com/errata/RHSA-2026:10184https://access.redhat.com/errata/RHSA-2026:12176https://access.redhat.com/errata/RHSA-2026:13508https://access.redhat.com/errata/RHSA-2026:13512https://access.redhat.com/errata/RHSA-2026:13545https://access.redhat.com/errata/RHSA-2026:13553https://access.redhat.com/errata/RHSA-2026:13672https://access.redhat.com/errata/RHSA-2026:13916https://access.redhat.com/errata/RHSA-2026:17083https://access.redhat.com/errata/RHSA-2026:19138https://access.redhat.com/errata/RHSA-2026:19355https://access.redhat.com/errata/RHSA-2026:19375https://access.redhat.com/errata/RHSA-2026:19712https://access.redhat.com/errata/RHSA-2026:21431https://access.redhat.com/errata/RHSA-2026:21517https://access.redhat.com/errata/RHSA-2026:22330https://access.redhat.com/errata/RHSA-2026:24977https://access.redhat.com/errata/RHSA-2026:26226https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:6568https://access.redhat.com/errata/RHSA-2026:6720https://access.redhat.com/errata/RHSA-2026:6912https://access.redhat.com/errata/RHSA-2026:6926https://access.redhat.com/errata/RHSA-2026:8437https://access.redhat.com/errata/RHSA-2026:8746https://access.redhat.com/errata/RHSA-2026:8747https://access.redhat.com/errata/RHSA-2026:8748https://access.redhat.com/security/cve/CVE-2026-32597https://bugzilla.redhat.com/show_bug.cgi?id=2447194https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9fhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json
2026-03-13
Published