PyJWT, a Python library for JSON Web Token handling, fails to validate the 'crit' header parameter in versions before 2.12.0. According to RFC 7515 §4.1.11, if a JWS token contains a 'crit' array listing extensions that the implementation does not understand, the token must be rejected. PyJWT prior to 2.12.0 incorrectly accepts such tokens, violating this MUST requirement. This flaw can lead to integrity violations as attackers may craft tokens with unrecognized critical extensions that are accepted by the library. The issue is tracked as CVE-2026-32597 and is associated with CWE-345 (Insufficient Verification of Data Authenticity), CWE-863, and CWE-347. The vulnerability has a CVSS v3.1 score of 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and impacts integrity but not confidentiality or availability. The vulnerability is fixed in PyJWT version 2.12.0.

An attacker can craft JSON Web Tokens with unknown critical header extensions that PyJWT versions prior to 2.12.0 will accept instead of rejecting. This violates the RFC specification and can lead to integrity issues, potentially allowing unauthorized actions or privilege escalation in systems relying on PyJWT for token validation. There is no impact on confidentiality or availability reported. No known exploits in the wild have been reported.

A fix is available in PyJWT version 2.12.0. Users should upgrade to version 2.12.0 or later to ensure proper validation of the 'crit' header parameter as per RFC 7515 §4.1.11. The Red Hat advisory notes that mitigation options other than upgrading do not meet their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.