In PyJWT versions 2.11.0 through 2.13.0, the _merge_options() method modifies a caller-supplied mutable options mapping when verify_signature is false. If the same mapping is reused later with verify_signature set to true, it may retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. This can lead to acceptance of signed tokens with invalid registered claims despite signature verification being enabled. Applications that do not reuse the same options mapping for multiple decode calls are not impacted.

The vulnerability allows an attacker to potentially bypass validation of important JWT claims such as expiration and audience if the application reuses the same mutable options mapping across decode calls with differing verify_signature settings. This could result in acceptance of tokens with invalid claims, impacting the integrity of authentication or authorization decisions. The CVSS score is 6.5 (medium severity) reflecting limited attack complexity but significant impact on integrity.

No official patch or fix is indicated in the provided data. To mitigate, applications should avoid reusing the same mutable options mapping across decode or decode_complete calls, especially when toggling verify_signature between false and true. Instead, create a fresh options mapping for each call to ensure proper claim validation. Check vendor advisories for updates or patches.