CVE-2026-32597

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345 CWE-863 CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2026
Last modified: Sep 10, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-325986.5OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password re CVE-2026-325995.3Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQ CVE-2026-326008.2xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either CVE-2026-326024.2Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condit CVE-2026-326036.5Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerab CVE-2026-326049.9Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a ba CVE-2026-326057.5nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to v CVE-2026-326067.6IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used CVE-2026-326075.4Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2 CVE-2026-326087.0Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands CVE-2026-326097.5Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration CVE-2026-32619.8A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the