CVE-2026-103001

A flaw was found in pyjwt. This vulnerability allows a remote attacker to bypass token validation checks when an application reuses an options configuration across multiple token decoding requests. Because the library unintentionally modifies the caller's shared configuration dictionary when signature verification is disabled, subsequent token verifications may retain disabled claim checks. As a result, an attacker could supply an expired or otherwise invalid JSON Web Token (JWT) that the application accepts as valid.

Red Hat is aware of this vulnerability in PyJWT. Applications that reuse a mutable options dictionary across decode operations may unintentionally disable registered-claim validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a fixed PyJWT version is available, create a new options dictionary for each decode() or decode_complete() call. Do not reuse a mutable options dictionary between calls with different verification settings.