CVE-2026-32597

A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

An IMPORTANT severity flaw was found in PyJWT, a Python JSON Web Token (JWT) library shipped in a broad set of Red Hat products, including Red Hat Ansible Automation Platform, Red Hat Enterprise Linux, Red Hat OpenShift AI and Red Hat AI Inference Server components, and Red Hat Quay. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 section 4.1.11: when a JSON Web Signature (JWS) token contains a crit array listing header extensions that PyJWT does not understand, the library accepts the token instead of rejecting it, violating a MUST requirement of the RFC. As a result, a remote attacker who can submit crafted tokens to an application that relies on PyJWT for JWT verification can have tokens carrying unrecognized critical header extensions accepted, undermining the integrity of the token validation the application depends on. Red Hat has rated this flaw as IMPORTANT with a CVSS 3.1 score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), consistent with the upstream severity. Affected Red Hat product streams are tracked with a delegated resolution, and fixes are being pursued by the responsible product teams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.