PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.5 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS

• CVE-2026-103001: 0.26% estimated exploitation activity in the next 30 days; percentile 17.41 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary PyJWT.decode()/decodecomplete() mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls (a config object, a module-level constant, a wrapper's self.options), a later call that explicitly sets verifysignature=True for a full, normal verification silently inherits the leftover verifyexp=False etc. from an earlier verifysignature=False call on the same object -- and accepts an expired, wrong-audience, wrong-issuer, or wrong-subject token as valid with no exception. Signature verification itself is unaffected; this is specifically a claims-check bypass. This is a regression of an already-fixed, closed issue: originally reported in #679 (2021), fixed in #743 (2022, via a shallow copy of options), and silently reintroduced by #1045 (merged 2025-03-05, a typing/logic refactor that dropped…

Published by the source

30 Sep 2026, 23:53 UTC

Last modified by the source

1 Oct 2026, 17:55 UTC

Source last checked

26 Oct 2026, 13:54 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-gvp8-978c-rx2q

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-gvp8-978c-rx2q

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-gvp8-978c-rx2q

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-103001

Advisory: PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
IDs: CVE-2026-103001, GHSA-gvp8-978c-rx2q
Record: https://patchnext.com/advisories/cve-2026-103001 (revision 3, source checked 26 Oct 2026, 13:54 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI pyjwt: affected >= 2.11.0, <= 2.13.0

## Suggested inspection (read-only)
- `python -m pip show pyjwt`: prints the installed version. Run with the environment that serves production active.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pyjwt.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-gvp8-978c-rx2q (GitHub-reviewed advisory GHSA-gvp8-978c-rx2q lists affected ranges: PyPI pyjwt >=2.11.0 <=2.13.0)
- Verified: https://osv.dev/vulnerability/GHSA-gvp8-978c-rx2q (OSV record GHSA-gvp8-978c-rx2q lists affected ranges: PyPI pyjwt >=2.11.0 <=2.13.0)

Commands are suggestions: review each one before running it.