PYSEC-2026-4147: PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Q: Which deployments are exposed to revocation bypass?

Deployments using PyJWT before 2.14.0 are exposed if they revoke or denylist JWTs by comparing the raw serialized token string. Equivalent tokens with altered signature-segment serialization may not match the stored raw token value.

Q: What does an attacker need to exploit this issue?

The attacker needs a valid compact JWS token and can append non-Base64URL characters to its signature segment. PyJWT can decode the altered segment to the same signature bytes as the original token.

Q: What should teams do if they use raw-token revocation checks?

Upgrade PyJWT to version 2.14.0. Until upgraded, raw serialized-token comparisons should not be relied on as the sole revocation mechanism for tokens processed by affected versions.

Published Sep 28, 2026

Updated

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64urldecode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.

Affected Software

1 affected component

pypi/pyjwt<2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PyJWT to a version that resolves this vulnerability.
Fixed in 2.14.0

Event History

Sep 28, 2026

CVE Published

via OSV·08:27 PM

Data Sourced

via OSV·08:27 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to revocation bypass?

Deployments using PyJWT before 2.14.0 are exposed if they revoke or denylist JWTs by comparing the raw serialized token string. Equivalent tokens with altered signature-segment serialization may not match the stored raw token value.

What does an attacker need to exploit this issue?

The attacker needs a valid compact JWS token and can append non-Base64URL characters to its signature segment. PyJWT can decode the altered segment to the same signature bytes as the original token.

What should teams do if they use raw-token revocation checks?

Upgrade PyJWT to version 2.14.0. Until upgraded, raw serialized-token comparisons should not be relied on as the sole revocation mechanism for tokens processed by affected versions.

PYSEC-2026-4147: PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to revocation bypass?

What does an attacker need to exploit this issue?

What should teams do if they use raw-token revocation checks?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to revocation bypass?

What does an attacker need to exploit this issue?

What should teams do if they use raw-token revocation checks?