CVE-2026-32597 is a vulnerability in the PyJWT Python library where versions before 2.12.0 fail to properly validate the 'crit' header parameter in JSON Web Signature tokens. According to RFC 7515 §4.1.11, if a JWS token contains a 'crit' array listing extensions that the implementation does not understand, the token must be rejected. PyJWT prior to 2.12.0 accepts such tokens, violating this MUST requirement. This insufficient verification of data authenticity can lead to acceptance of tokens with unrecognized critical extensions, potentially undermining the integrity of token validation. The issue is addressed in PyJWT 2.12.0. Red Hat advisories confirm the vulnerability and provide patches in their Ansible Automation Platform packages that include updated PyJWT versions.

The vulnerability allows PyJWT to accept JWS tokens containing unknown critical header extensions without rejection, violating the RFC's mandatory validation requirements. This can lead to improper token validation, potentially allowing attackers to bypass intended security controls that rely on token authenticity and integrity. The CVSS score of 7.5 (High) reflects the significant impact on integrity without requiring privileges or user interaction.

A fix is available in PyJWT version 2.12.0, which properly validates the 'crit' header parameter as per RFC 7515 §4.1.11. Users should upgrade to PyJWT 2.12.0 or later to remediate this vulnerability. Red Hat has issued security advisories and updates for their Ansible Automation Platform 2.5 packages that include this fix. Applying these vendor-provided updates is recommended to ensure the vulnerability is addressed.