CVE-2026-32597: PyJWT Accepts Unknown `crit` Header Extensions Leading to Security Bypass
Summary
CVE-2026-32597: PyJWT accepts unknown crit header extensions. Affects pyjwt versions < 2.12.0. Fixed in 2.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyJWT is a Python library used for encoding and decoding JSON Web Tokens (JWT). It provides a simple way to handle JWTs, allowing developers to securely transmit information between parties. However, PyJWT has a vulnerability that allows it to accept tokens with unknown critical header extensions, which can lead to security policy bypasses.
Vulnerability Detail
The vulnerability arises from PyJWT's failure to validate the crit (Critical) Header Parameter as defined in RFC 7515. When a JWS token contains a crit array with extensions that PyJWT does not recognize, it incorrectly accepts the token instead of rejecting it. This behavior violates the RFC's requirement that any unknown critical extensions must render the JWS invalid. The implications of this vulnerability include potential split-brain verification in mixed-library environments, security policy bypasses, and silent ignoring of critical extensions that enforce security measures such as multi-factor authentication.
How To Fix
Latest published version: 2.15.1 as of 23 Oct 2026
pip install --upgrade "pyjwt==2.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.12.0
This is the first release that contains the fix.
pip install --upgrade "pyjwt==2.12.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a manual check for the crit header in your application. Here is an example of how to validate the crit header before decoding the token:
import jwt
def validate_crit(headers):
crit = headers.get('crit')
if crit is not None:
if not isinstance(crit, list) or len(crit) == 0:
raise jwt.InvalidTokenError('crit must be a non-empty array')
for ext in crit:
raise jwt.InvalidTokenError(f'Unsupported critical extension: {ext}')
# Use this function before decoding your token
Conclusion
The vulnerability CVE-2026-32597 in PyJWT allows for the acceptance of tokens with unknown critical extensions, posing significant security risks. It is crucial to update to the patched version and implement additional validation to safeguard against potential exploits.
See every vulnerability recorded for pyjwt →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The crit header indicates that certain extensions must be understood and processed by the recipient. If any listed extensions are not recognized, the token should be considered invalid.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include security policy bypasses, split-brain verification in mixed-library deployments, and silent ignoring of critical security measures.
Regularly update your dependencies, monitor for vulnerabilities using tools like Vulert, and implement proper validation for JWT headers.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyjwt.
