The vulnerability
CVE-2026-32597 is an information-disclosure / authentication weakness in the popular PyJWT library (CWE-345, “Insufficient Verification of Data Authenticity”). PyJWT’s token-validation logic does not enforce RFC 7515 section 4.1.11, which requires rejecting tokens that contain unrecognized values in the crit (critical) header array. As a result, an attacker who can craft a malicious JWT may have critical extensions silently ignored, potentially bypassing authentication in apps that rely on PyJWT as their sole defense.
Impact and exposure
- The attack is network-based, requires no privileges or user interaction, and is tracked as part of the broader npm/PyPI supply-chain threat landscape.
- Any service validating JWTs with a vulnerable PyJWT version is potentially affected.
What to do
Upgrade to a patched PyJWT release, audit which version your dependencies pin, and verify JWT libraries enforce the crit header correctly. Treat this as a prompt to add integrity checking (for example pip hash checking) and monitor advisories from PyPI and GitHub Security.
Source: SentinelOne Vulnerability Database; GitHub Security Advisory (2026).