PyJWT, a Python implementation of JSON Web Token standards, has a vulnerability (CWE-180) in versions before 2.14.0 where the signature segment decoding accepts characters outside the canonical Base64URL set. When non-Base64URL characters are appended to a valid compact JWS signature segment, base64url_decode produces the same signature bytes for different serialized segments. This can cause raw-token revocation checks to fail to recognize modified tokens as equivalent, potentially allowing revoked tokens to be accepted. The vulnerability is addressed in PyJWT version 2.14.0.

The vulnerability allows different serialized tokens with appended non-Base64URL characters to decode to the same signature bytes, which can cause token revocation mechanisms that rely on raw token comparison to fail. This may lead to acceptance of revoked tokens, impacting the integrity of token validation. The CVSS score is 4.8 (medium severity), indicating limited impact with network attack vector, high attack complexity, no privileges required, no user interaction, and low confidentiality and integrity impact.

Upgrade PyJWT to version 2.14.0 or later where this issue is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 2.14.0.