🟠 High | Source: Microsoft Security Response Center
CVE-2026-32597 is a vulnerability in the PyJWT library where it incorrectly accepts unknown ‘crit’ (critical) header extensions in JSON Web Tokens, violating a mandatory requirement in the JWT/JWS specification (RFC 7515 §4.1.11). This means an attacker could craft a JWT containing unrecognised critical headers that should be rejected, potentially bypassing validation logic in applications relying on PyJWT for authentication or authorisation. Any Azure or cloud-hosted application using PyJWT to validate tokens may be at risk if the consuming application assumes unrecognised critical extensions are properly enforced.
Security Architect’s Take: Audit all workloads and APIs using PyJWT for token validation and update to a patched version immediately; pay particular attention to services where JWT validation acts as an authentication or authorisation gate, as a bypass here could allow privilege escalation or unauthorised access.
Original advisory: CVE-2026-32597 PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation)