PYSEC-2026-120: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Q: Which deployments are exposed?

Applications using PyJWT versions earlier than 2.12.0 are affected when they process JWS tokens that contain a crit header listing extensions the library does not understand.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a JWS token with a crit array containing unknown critical header extensions. No authentication or user interaction is required according to the supplied vector.

Q: What should be done to remediate the issue?

Upgrade PyJWT to version 2.12.0 or later, which validates the crit header parameter and rejects unsupported critical extensions.

Published Mar 12, 2026

Updated

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Affected Software

1 affected component

pypi/pyjwt<2.12.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.12.0

Event History

Mar 12, 2026

CVE Published

via OSV·09:41 PM

Data Sourced

via OSV·09:41 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Applications using PyJWT versions earlier than 2.12.0 are affected when they process JWS tokens that contain a crit header listing extensions the library does not understand.

What does an attacker need to exploit this issue?

An attacker needs to provide a JWS token with a crit array containing unknown critical header extensions. No authentication or user interaction is required according to the supplied vector.

What should be done to remediate the issue?

Upgrade PyJWT to version 2.12.0 or later, which validates the crit header parameter and rejects unsupported critical extensions.

PYSEC-2026-120: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should be done to remediate the issue?