PyJWT versions including 2.13.0 accept compact JWS signature segments with non-canonical Base64URL characters, allowing alternate token serializations that decode to the same signature bytes and claims. This can enable bypass of raw-token-based revocation or logout mechanisms if the application uses the raw serialized token string as the identity for revocation or replay state. The vulnerability does not allow signature forgery or claim alteration. A fix has been developed to reject non-canonical Base64URL characters in signature segments but is not yet released.