PyJWT is a widely used Python library for encoding and decoding JSON Web Tokens (JWTs), which are commonly employed for authentication and authorization in web applications and APIs. According to RFC 7515 §4.1.11, the 'crit' header parameter in a JWS token is a critical extension indicator that mandates the recipient to understand and process all listed extensions; otherwise, the token must be rejected. Prior to version 2.12.0, PyJWT failed to enforce this requirement, allowing tokens with unrecognized critical extensions to be accepted without proper validation. This constitutes an insufficient verification of data authenticity (CWE-345) and improper restriction of operations within the security policy (CWE-863). An attacker could craft a malicious JWT containing critical extensions that PyJWT ignores, potentially bypassing signature verification or injecting unauthorized claims. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting its high severity due to network exploitability, no required privileges or user interaction, and a direct impact on data integrity. The flaw affects all PyJWT versions before 2.12.0 and is resolved by upgrading to 2.12.0 or later. No public exploits have been reported yet, but the vulnerability's nature makes it a serious concern for any application relying on PyJWT for secure token validation.

The primary impact of this vulnerability is on the integrity of authentication and authorization mechanisms that rely on PyJWT. Attackers could exploit this flaw to craft JWTs that bypass signature verification or inject unauthorized claims, potentially gaining unauthorized access to protected resources or escalating privileges within applications. This undermines trust in token-based security models and can lead to data breaches, unauthorized transactions, or service misuse. Since JWTs are widely used in modern web applications, APIs, and microservices architectures, the vulnerability could affect a broad range of organizations globally, especially those using Python-based backends with PyJWT for session management or API security. The lack of required authentication or user interaction for exploitation increases the risk of automated attacks. Although availability and confidentiality impacts are minimal, the integrity compromise alone is critical for security-sensitive environments.

Organizations should immediately audit their use of PyJWT and identify any deployments running versions prior to 2.12.0. The primary mitigation is to upgrade PyJWT to version 2.12.0 or later, where the vulnerability is fixed by proper validation of the 'crit' header parameter according to RFC 7515. Additionally, developers should implement defense-in-depth by validating JWTs at multiple layers, including verifying token claims and signatures explicitly and employing strict schema validation for JWT contents. Security teams should monitor logs for suspicious JWT usage patterns and consider implementing anomaly detection for token anomalies. For environments where immediate upgrade is not feasible, custom patches or token validation wrappers that enforce 'crit' header checks can be applied. Finally, organizations should review their overall JWT usage policies and educate developers about secure JWT handling best practices to prevent similar issues.