PyJWT - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pyjwt/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 08 Aug 2026 09:32:04 +0000PyJWT Improper Handling of Critical Header Extensions (CVE-2026-32597)https://feed.craftedsignal.io/briefs/2026-08-pyjwt-crit-header-vulnerability/Sat, 08 Aug 2026 09:32:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-pyjwt-crit-header-vulnerability/The PyJWT library fails to reject unknown 'crit' header extensions as required by RFC 7515, creating a potential bypass vulnerability in JWT integrity and authentication checks.CVE-2026-32597 identifies a specification compliance vulnerability within the PyJWT library where the parser incorrectly handles the 'crit' (critical) header parameter defined in JSON Web Signature (JWS) specifications. According to RFC 7515 ยง4.1.11, a JWT validator must reject any JWS if it contains a 'crit' header parameter that includes extensions not understood by the application. Because PyJWT currently accepts these unknown extensions, an attacker may be able to craft malicious JWTs that include unsupported critical headers to bypass security validations, potentially leading to unauthorized access or identity spoofing depending on how the application processes the claims. This vulnerability impacts applications relying on PyJWT for critical authentication and authorization workflows.

Impact

Successful exploitation could allow an attacker to bypass authentication mechanisms or modify the behavior of the validation process by including unrecognized but critical headers. This could result in the acceptance of malformed or unauthorized tokens. The scope of impact is dependent on the specific implementation of the downstream application using the vulnerable PyJWT library version.

Recommendation

  • Identify applications and microservices using PyJWT versions vulnerable to CVE-2026-32597.
  • Update the PyJWT dependency to the latest patched version provided by the maintainer.
  • Review application logic that processes JWS tokens to ensure strict validation of header parameters where possible until patching is complete.
]]>mediumadvisory