PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
Priority MEDIUM 62CWE-471Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Partial Red Hat: 2 fixed, 26 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial Red Hat: 7 advisoriesRed Hat: 2 fixed, 26 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jpadilla | pyjwt | 2.11.0 – 2.13.0 | — | No fix listed | CNA |
| — | PyJWT (PyPI) | 2.11.0 – 2.13.0 | — | No fix listed | GHSA-gvp8-978c-rx2q |
- pyjwt Vendorjpadilla Affected 2.11.0 – 2.13.0 Fixed in — No fix listed CNA
- PyJWT (PyPI) Vendor— Affected 2.11.0 – 2.13.0 Fixed in — No fix listed GHSA-gvp8-978c-rx2q
Remediation
Red Hat 7 advisories
- RHSA-2026:92452 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:92449 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:82415 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cpu)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Show 4 more Red Hat advisories
- RHSA-2026:82371 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (spyre)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
- RHSA-2026:82368 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cuda)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:82061 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference Tech Preview 3.5.2 (Gaudi)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
- RHSA-2026:82059 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (ROCm)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Fence Agents Remediation Operator | Affected | No fix yet: Fix deferred |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 4 for Cloud Providers | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 5 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415 |
| Red Hat Enterprise Linux AI 3.5 | Fixed | RHSA-2026:92449, RHSA-2026:92452 |
Not affected: 4 products
- OpenShift Lightspeed
- Red Hat Enterprise Linux command line assistant
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-103001
- 2026-10-03 Alias added: GHSA-gvp8-978c-rx2q
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-06 Priority changed: LOW → MEDIUM
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
- 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More jpadilla Pyjwt vulnerabilities
- TI-2026-65303 Improper signature verification in jpadilla pyjwt CVSS 3.1CRITICAL 9.1
- TI-2026-65301 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVSS 3.1CRITICAL 9.1
- TI-2026-65219 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse… CVSS 3.1HIGH 7.5
- TI-2026-65218 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVSS 3.1HIGH 7.5
- TI-2026-25107 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVSS 3.1HIGH 7.5
- TI-2026-65310 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVSS 3.1HIGH 8.2
Sources
- CVE-2026-103001 · CVE Program
- CVE-2026-103001 · NVD
- FIRST EPSS
- GHSA-gvp8-978c-rx2q · GitHub Advisory Database · CC BY 4.0
- CVE-2026-103001 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences