cyfenced.com →

[ CVE-2026-103001 · Published 30 Sep 2026 ]

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

CVSS 6.5 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1249

    Multiple vulnerabilities in VMware products Translated from French

    Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

    CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs

[ Packages ]Affected open-source packages

[ References ]References