The vulnerability allows an attacker to append characters that are not part of the Base64URL alphabet to the signature segment of a JSON Web Signature (JWS). The PyJWT decoder accepts these non‑canonical characters, producing the same signature bytes for multiple serialized representations. Consequently, a token that has been modified can appear unchanged to raw‑token revocation logic, allowing a revoked JWT to be accepted and used by an application.

All released versions of the PyJWT library older than 2.14.0 are affected. Users of the library from any source should verify that their installed module is version 2.14.0 or later.

The CVSS score of 4.8 denotes moderate severity. The EPSS score indicates a very low but nonzero exploitation probability (< 1 %). The vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. Exploitation requires that an attacker can supply or influence a JWT; if the application performs raw revocation checks, the flaw can allow bypassing that check. The attack path is typically the deliberate construction of a modified token that decodes to identical signature bytes, relying on the decoder’s permissiveness.