Vulnerability · Published Sep 30, 2026 · Assigned by GitHub_M

CVE-2026-103001PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Medium 6.5

In plain English

A medium-severity security flaw in pyjwt from jpadilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 82.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	pyjwt	2.14.0-1	DEBIAN-CVE-2026-103001
PyPI	pyjwt	no fix listed	GHSA-gvp8-978c-rx2q
PyPI	pyjwt	no fix listed	PYSEC-2026-4146
Ubuntu:22.04:LTS	pyjwt	no fix listed	UBUNTU-CVE-2026-103001
Ubuntu:24.04:LTS	pyjwt	no fix listed	UBUNTU-CVE-2026-103001
Ubuntu:26.04:LTS	pyjwt	no fix listed	UBUNTU-CVE-2026-103001
Ubuntu:26.10	pyjwt	no fix listed	UBUNTU-CVE-2026-103001

Affected products (as reported)

Vendor	Product	Versions
jpadilla	pyjwt	>= 2.11.0, <= 2.13.0

Weakness: CWE-471 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/issues/679 x_refsource_MISC
https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35 x_refsource_MISC