https://vulnerability.circl.lu/sightings/feed 2026-10-02T17:16:40.931232+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a3a1ea04-aeba-4dc9-b9ec-209d47ce4ddf/export 2026-10-02T17:16:40.963874+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a3a1ea04-aeba-4dc9-b9ec-209d47ce4ddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103001", "type": "seen", "source": "https://gist.github.com/alon710/ae5f872dc1573f4f9211b4ab5e48215f", "content": "# CVE-2026-103001: CVE-2026-103001: State Pollution in PyJWT Option Merging Leads to Claim Verification Bypass\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-103001\n\n## Summary\nPyJWT versions 2.11.0 through 2.13.0 suffer from a state pollution vulnerability in the `_merge_options` method. When an application passes a mutable configuration mapping with signature verification disabled, the library modifies the object in-place. If this same dictionary is reused for subsequent verified decode operations, standard claim verifications (such as expiration, audience, and issuer validation) are silently bypassed.\n\n## TL;DR\nA state pollution flaw in PyJWT's options merger mutates reused configuration dictionaries. When signature verification is toggled from False to True, critical claim verifications like expiration and audience checks remain permanently disabled, allowing expired or invalid tokens to be accepted.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-471: Modification of Assumed-Immutable Data (MAID)\n- **Attack Vector**: Network (Unauthenticated, high complexity due to application logic dependence)\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: N/A\n- **Impact**: Claim verification bypass (Expiration, Audience, Issuer checks bypassed)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Python applications utilizing PyJWT version 2.11.0 through 2.13.0 with reused or shared verification options dictionaries\n- **PyJWT**: >= 2.11.0, <= 2.13.0 (Fixed in: `2.14.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or above\n- Ensure options dictionaries are not reused across sequential jwt.decode() or jwt.decode_complete() invocations\n- Enforce explicit creation of option dictionary copies inside application middleware config builders\n\n**Remediation Steps:**\n1. Locate requirement files (such as requirements.txt, setup.py, or Pipfile) and bump the pyjwt dependency to '>= 2.14.0'\n2. Run pip install --upgrade pyjwt in the development environment and verify the installed package version\n3. Audit JWT handling middleware to ensure options arguments are not stored globally or in persistent application contexts\n\n## References\n\n- [GitHub Security Advisory: Claim Verification Bypass due to State Pollution](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q)\n- [Fix commit implementing dict conversion within _merge_options](https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35)\n- [PyJWT Issue 679: Dictionary Mutated in-place During Decoding Process](https://github.com/jpadilla/pyjwt/issues/679)\n- [Official CVE-2026-103001 Record](https://www.cve.org/CVERecord?id=CVE-2026-103001)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-103001) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T03:30:31.000000Z"} 2026-10-01T03:30:31+00:00 https://vulnerability.circl.lu/sighting/bfdfd33c-4db0-4407-8bbb-bd5f969043e9/export 2026-10-02T17:16:40.967970+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "bfdfd33c-4db0-4407-8bbb-bd5f969043e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-103001", "type": "published-proof-of-concept", "source": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q", "content": "", "creation_timestamp": "2026-09-08T20:06:01.000000Z"} 2026-09-08T20:06:01+00:00