[pkg-vuln] CVE-2026-103001 in pyjwt@2.13.0 #912

New Issue

kert · 2026-10-01T06:01:53Z

kert commented

2026-10-01 06:01:53 +00:00

Severity: MEDIUM
Package: pyjwt @ 2.13.0
Fixed in: none

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-103001

**Severity:** MEDIUM **Package:** `pyjwt` @ `2.13.0` **Fixed in:** `none` PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-103001

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-01 06:01:53 +00:00

kert added the quality ci labels 2026-10-01 06:01:53 +00:00

kert closed this issue

2026-10-27 16:15:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#912