CVE-2026-103001

Received Received - Intake

Path Traversal in PyJWT Library

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-103001

Affected Vendors & Products

Vendor	Product	Version / Range
pyjwt	pyjwt	From 2.11.0 (inc) to 2.13.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-471	The product does not properly protect an assumed-immutable element from being modified by an attacker.

Attack-Flow Graph

Executive Summary

PyJWT versions 2.11.0 through 2.13.0 contain a flaw in the PyJWT._merge_options() method. When verify_signature is set to false, this method can modify a mutable options mapping provided by the caller. If the same mapping is reused later with verify_signature set to true, it may retain incorrect values for claim checks like expiration, not-before, issued-at, audience, issuer, subject, and JWT ID. This could allow a signed token with invalid registered claims to be accepted even when signature verification is enabled.

Detection Guidance

This vulnerability affects PyJWT versions 2.11.0 through 2.13.0. To detect it, check the installed PyJWT version using pip show PyJWT. If the version is within the affected range, update to the latest version immediately. No specific network or system commands are provided in the context to detect exploitation.

Impact Analysis

This vulnerability could allow attackers to bypass security checks in applications using PyJWT. If an application reuses an options mapping without creating a new one for each decode operation, it might accept tokens with invalid claims even when signature verification is enabled. This could lead to unauthorized access or data manipulation if the application relies on these claims for security decisions.

Compliance Impact

This vulnerability could allow improper validation of JWT tokens, potentially leading to unauthorized access or data exposure. For GDPR, this may violate principles of data protection and integrity. For HIPAA, it could compromise the confidentiality and integrity of protected health information if tokens are not properly verified.

Mitigation Strategies

Upgrade PyJWT to a version outside the affected range (2.11.0 through 2.13.0). Avoid reusing mutable options mappings across decode calls when verify_signature is false.

Hi! I’m here to help you understand CVE-2026-103001. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70